California

Law: California Consumer Privacy Act of 2018

The act's official or short title as the statute or the state's official page gives it, with its code citation if stated.

The California Consumer Privacy Act of 2018 (CCPA) gives consumers more control

Source: https://oag.ca.gov/privacy/ccpa. Read 2026-11-01. Read once.

Takes effect: Not looked at yet

The first date the law's main consumer-privacy duties apply to businesses, as stated by the statute or state. Ignore later phase-ins for specific provisions.

No source we could use stated this. A blank never means no.

Who it applies to: Have a gross annual revenue of over $25 million

The law's applicability threshold in short form, as the statute states it, such as revenue or number of consumers processed.

Have a gross annual revenue of over $25 million

Source: https://oag.ca.gov/privacy/ccpa. Read 2026-11-01. Read once.

Consumers threshold: 100000 consumers

The lowest number of state consumers whose personal data triggers the law on its own, without a revenue test. Null if the law has no such number.

Buy, sell, or share the personal information of 100,000 or more California residents or households

Source: https://oag.ca.gov/privacy/ccpa. Read 2026-11-01. Read once.

Cure period: Not looked at yet

Days the statute gives a business to fix a violation before enforcement. Null if the law gives no right to cure.

No source we could use stated this. A blank never means no.

Cure period ends: Not looked at yet

The date the right to cure sunsets, as stated in the statute. Null if there is no cure period or it does not expire.

No source we could use stated this. A blank never means no.

Enforced by: Not looked at yet

The official or agency the statute names as enforcer.

No source we could use stated this. A blank never means no.

Maximum penalty: Not looked at yet

The highest civil penalty per violation stated in the statute, including higher tiers such as intentional violations. Use the statute's base figure, not inflation-adjusted amounts, unless the statute itself states the adjusted figure.

No source we could use stated this. A blank never means no.

Private right of action: Yes

True if consumers can sue directly under the law for any violation. False if the statute says it creates no private right of action or leaves enforcement solely to the state.

you can sue for the amount of monetary damages you actually suffered from the breach

Source: https://oag.ca.gov/privacy/ccpa. Read 2026-11-01. Read once.

Opt-out signal required: Yes

True if the statute requires businesses to honor a universal opt-out signal or preference signal, such as Global Privacy Control, now or by a stated date.

Under law, it must be honored by covered businesses as a valid consumer request to stop the sale or sharing of personal information.

Source: https://oag.ca.gov/privacy/ccpa. Read 2026-11-01. Read once.