CCPA compliance, honor consumer privacy rights
Route consumer requests, keep notices accurate, and prepare for the new automated-decision, risk-assessment and audit rules.
The California Consumer Privacy Act, as amended by the CPRA, gives California residents rights to know, delete, correct and opt out of the sale or sharing of their personal information. It applies to for-profit businesses above revenue or data-volume thresholds. New CPPA rules on automated decisions, risk assessments and cybersecurity audits took effect on 1 January 2026.
TL;DR
- Rights: know, delete, correct, opt out of sale or sharing, and limit sensitive-data use.
- New CPPA regulations took effect on 1 January 2026.
- Automated decision-making (ADMT) duties apply from 1 January 2027.
- Risk-assessment attestations and the first cybersecurity audits are due from 1 April 2028.
Reviewed by the ComplyEasyAI compliance teamLast reviewed
Sources: CPPA, regulations approved (23 September 2025)CPPA, CCPA updates
What does CCPA require?
The requirements below define CCPA. ComplyEasyAI maps your environment to each one.
Right to know & access
Disclose what personal information you collect and how it is used.
Right to delete
Delete personal information on verified request, with exceptions.
Right to opt out
Let consumers opt out of the sale or sharing of their information.
Right to correct
Correct inaccurate personal information on request.
Sensitive PI limits
Honor limits on the use of sensitive personal information.
When do CCPA obligations apply?
- CPPA regulations on risk assessments, cybersecurity audits and automated decision-making take effect.
- Businesses using automated decision-making technology for significant decisions must comply with the ADMT rules.
- Risk-assessment attestations and summaries are due; first cybersecurity audits for businesses with revenue over $100 million.
- Cybersecurity audits due for businesses with revenue of $50–100 million.
- Cybersecurity audits due for businesses with revenue under $50 million.
How do you prepare for CCPA?
Scope
Define the systems, boundaries and requirements your program will cover.
Connect your stack
Link cloud, identity, code and ticketing systems, read-only for evidence collection; controls are discovered and mapped.
Collect evidence
AI agents gather configuration and activity evidence on a schedule, building a versioned trail.
Monitor & remediate
Continuous monitoring flags drift the moment it happens and routes it to an owner.
Track effectiveness
Operating effectiveness is recorded over time, ready for your observation window.
Report & hand off
Organized, current evidence is packaged for auditors and stakeholders.
How does ComplyEasyAI automate CCPA compliance?
Control mapping
Your environment is mapped to each requirement, so you see exactly which control satisfies what.
Automated evidence
Integrations build a versioned, timestamped evidence trail instead of manual screenshots.
Continuous monitoring
Drift surfaces as soon as it happens, not during fieldwork.
Readiness dashboards
Real-time views highlight failing or unmapped controls with owners attached.
Multi-framework reuse
Shared controls are mapped once and reused across every framework you run.
Audit-ready reporting
Export organized, current evidence packages on demand.
Which frameworks are related to CCPA?
CCPA FAQ
Does CCPA apply to my business?
It applies to for-profit businesses doing business in California that exceed the inflation-adjusted annual revenue threshold, buy, sell or share the personal information of 100,000 or more consumers or households, or earn half their annual revenue from selling or sharing it.
What did CPRA add?
CPRA added the right to correct, protections for sensitive personal information and a dedicated enforcement agency, the California Privacy Protection Agency (CPPA).
What changed in 2026?
CPPA regulations effective 1 January 2026 require risk assessments for high-risk processing and phased cybersecurity audits, the first due 1 April 2028. From 1 January 2027 they also add notice, opt-out and access rights for automated decision-making used in significant decisions.
How does it relate to GDPR?
They share concepts like access and deletion, so much of the operational work overlaps.
How do you help?
The platform routes and tracks consumer requests and keeps privacy notices aligned with what you actually collect.
Start your CCPA program.
Map the requirements, automate the evidence, stay audit-ready.