CCPA/CPRA Compliance

The California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), applies to qualifying businesses that handle the personal information of California residents. Duties depend on the business and processing context; it is incorrect to assume every small website anywhere in the world has identical CCPA obligations. Core areas can include required notices, access and deletion rights, correction requests, and rights to opt out of certain sales or sharing of personal information.

Privacy teams must determine whether the business falls within statutory thresholds, what personal information it collects, which service providers receive it, and whether targeted-advertising relationships create sale or sharing obligations. A website banner is not an all-purpose compliance solution. Consumer request procedures, retention practices, vendor contracts and security controls may be equally important.

California rules change. The California Privacy Protection Agency lists law and regulations effective January 1, 2026, including additional requirements adopted in 2025 for specified risk assessments, cybersecurity audits and automated decision-making activities. Those obligations do not necessarily apply to every covered organization in the same way or on the same schedule. This overview is not legal advice; a final implementation should be checked against current California rules and professional counsel where appropriate.