PrivacyTerrain

Editorial caveat

Structured values summarize official materials for research and planning. They are reviewed by humans before publication and should not be treated as legal advice.

high confidence, Leading US state regime with expanded rights and enforcement field coverage. Public interpretation should still frame it as one subnational layer within a wider US privacy model.

Parent context: This jurisdiction sits within United States, and should be interpreted as part of that broader regime structure.

At a glance

Key presentation points

A compact summary of high-signal fields before the full structured record.

Effective statusin-force1 primary + 1 secondary • Reviewed 15/04/2026

Territorial scopeApplies to covered businesses doing business in California and meeting statutory thresholds.1 primary + 1 secondary • Reviewed 15/04/2026

Requires legal basisNo1 primary + 1 secondary • Reviewed 15/04/2026

Maximum fineAgency enforcement up to $2,500 per violation or $7,500 for intentional or children's-data violations.1 primary + 1 secondary • Reviewed 15/04/2026

Structured record

Regulation details grouped by topic

Each value keeps its field context, linked sources, notes, and review date together to avoid detached or ambiguous statements.

Identity

Effective status: in-forceSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: California legislative information (primary); California Privacy Protection Agency regulations (secondary)Note: Starter MVP editorial summary based on official source set.
Law status: activeSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: California legislative information (primary); California Privacy Protection Agency regulations (secondary)Note: Starter MVP editorial summary based on official source set.
Effective date: 2023-01-01Support: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: California legislative information (primary); California Privacy Protection Agency regulations (secondary)Note: Starter MVP editorial summary based on official source set.
Last amended: 2023-03-29Support: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: California legislative information (primary); California Privacy Protection Agency regulations (secondary)Note: Starter MVP editorial summary based on official source set.

Scope

Extraterritorial application: YesSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: California legislative information (primary); California Privacy Protection Agency regulations (secondary)Note: Starter MVP editorial summary based on official source set.
Territorial scope: Applies to covered businesses doing business in California and meeting statutory thresholds.Support: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: California legislative information (primary); California Privacy Protection Agency regulations (secondary)Note: Starter MVP editorial summary based on official source set.
Private sector coverage: YesSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: California legislative information (primary); California Privacy Protection Agency regulations (secondary)Note: Starter MVP editorial summary based on official source set.
Public sector coverage: NoSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: California legislative information (primary); California Privacy Protection Agency regulations (secondary)Note: Starter MVP editorial summary based on official source set.

Definitions

Personal data definition: Information that identifies, relates to, describes, or could reasonably be linked with a consumer or household.Support: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: California legislative information (primary); California Privacy Protection Agency regulations (secondary)Note: Starter MVP editorial summary based on official source set.
Sensitive data recognized: YesSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: California legislative information (primary); California Privacy Protection Agency regulations (secondary)Note: Starter MVP editorial summary based on official source set.

Legal Basis

Legal bases: Support: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: California legislative information (primary); California Privacy Protection Agency regulations (secondary)Note: Starter MVP editorial summary based on official source set.
Requires legal basis: NoSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: California legislative information (primary); California Privacy Protection Agency regulations (secondary)Note: Starter MVP editorial summary based on official source set.

Rights

Right of access: YesSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: California legislative information (primary); California Privacy Protection Agency regulations (secondary)Note: Starter MVP editorial summary based on official source set.
Right to deletion: YesSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: California legislative information (primary); California Privacy Protection Agency regulations (secondary)Note: Starter MVP editorial summary based on official source set.
Right to object: YesSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: California legislative information (primary); California Privacy Protection Agency regulations (secondary)Note: Starter MVP editorial summary based on official source set.
Right to portability: YesSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: California legislative information (primary); California Privacy Protection Agency regulations (secondary)Note: Starter MVP editorial summary based on official source set.
Right to appeal: NoSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: California legislative information (primary); California Privacy Protection Agency regulations (secondary)Note: Starter MVP editorial summary based on official source set.
Right to delete: YesSupport: 1 primary • Reviewed 17/04/2026Sources: California legislative information (primary)Note: California consumers have a statutory deletion right under the CCPA/CPRA framework, subject to exceptions.
Right to correct: YesSupport: 1 primary • Reviewed 17/04/2026Sources: California legislative information (primary)Note: California consumers have a statutory correction right under the CPRA amendments.
Opt-out rights summary: Sale, sharing, certain profiling-related usesSupport: 1 primary • Reviewed 17/04/2026Sources: California legislative information (primary)Note: California provides opt-out rights centered on sale and sharing, with broader regulatory nuance under the CPRA framework.

Breach

Breach deadline (hours): Immediate / without undue delaySupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: California legislative information (primary); California Privacy Protection Agency regulations (secondary)Note: Starter MVP editorial summary based on official source set.
Breach notification required: YesSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: California legislative information (primary); California Privacy Protection Agency regulations (secondary)Note: Starter MVP editorial summary based on official source set.

Governance

DPO required: NoSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: California legislative information (primary); California Privacy Protection Agency regulations (secondary)Note: Starter MVP editorial summary based on official source set.
Impact assessment required: YesSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: California legislative information (primary); California Privacy Protection Agency regulations (secondary)Note: Starter MVP editorial summary based on official source set.
Records of processing required: NoSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: California legislative information (primary); California Privacy Protection Agency regulations (secondary)Note: Starter MVP editorial summary based on official source set.

Enforcement

Maximum fine: Agency enforcement up to $2,500 per violation or $7,500 for intentional or children's-data violations.Support: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: California legislative information (primary); California Privacy Protection Agency regulations (secondary)Note: Starter MVP editorial summary based on official source set.
Private right of action: YesSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: California legislative information (primary); California Privacy Protection Agency regulations (secondary)Note: Starter MVP editorial summary based on official source set.
Enforcement authority summary: CPPA and California Attorney GeneralSupport: 1 primary • Reviewed 17/04/2026Sources: California legislative information (primary)Note: California uses a dedicated privacy agency plus Attorney General enforcement, distinct from many other US state models.

Transfers

Cross-border transfer restricted: NoSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: California legislative information (primary); California Privacy Protection Agency regulations (secondary)Note: Starter MVP editorial summary based on official source set.
Data localization required: NoSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: California legislative information (primary); California Privacy Protection Agency regulations (secondary)Note: Starter MVP editorial summary based on official source set.

Marketing

Cookie consent rule: No blanket cookie consent rule, but sharing and sale opt-out signals matter.Support: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: California legislative information (primary); California Privacy Protection Agency regulations (secondary)Note: Starter MVP editorial summary based on official source set.

Official sources

California legislative informationPrimary official law • en • html
California Privacy Protection Agency regulationsSecondary official material • en • html

California