What are the CCPA / CPRA compliance deadlines?

Jan 1, 2020: CCPA takes effect. Jan 1, 2023: CPRA amendments operative. Jan 1, 2025: CPI adjustment of thresholds and fines. Sep 22, 2025: ADMT, risk assessment and cybersecurity audit regulations approved. Jan 1, 2026: New CCPA regulations take effect. Jan 1, 2027: ADMT requirements compliance date. Jan 1, 2027: Browsers must support opt-out preference signal (AB 566). Dec 31, 2027: Risk assessments for pre-existing processing due. Apr 1, 2028: First risk assessment submission to CPPA. Apr 1, 2028: Cybersecurity audit due: revenue over $100M. Apr 1, 2029: Cybersecurity audit due: revenue $50M-$100M. Apr 1, 2030: Cybersecurity audit due: revenue under $50M.

When does CCPA / CPRA take effect?

CCPA / CPRA took effect on Jan 1, 2020. The next milestone is Jan 1, 2027: ADMT requirements compliance date.

Who does CCPA / CPRA apply to?

For-profit businesses doing business in California that meet any of: annual gross revenue over $25M as CPI-adjusted ($26,625,000 from Jan 1, 2025); buy, sell or share personal information of 100,000+ consumers or households; or derive 50%+ of annual revenue from selling or sharing personal information. Cybersecurity audits apply to businesses deriving 50%+ revenue from selling/sharing PI, or over the revenue threshold and processing PI of 250,000+ consumers/households or sensitive PI of 50,000+ consumers.

What are the penalties under CCPA / CPRA?

Administrative fines/civil penalties up to $2,663 per violation and $7,988 per intentional violation or violation involving minors under 16 (CPI-adjusted from Jan 1, 2025; statutory base $2,500/$7,500). Private right of action for data breaches: $107-$799 per consumer per incident or actual damages. No statutory cure period (the 30-day cure was removed by the CPRA; CPPA may consider cure discretionarily).

CCPA / CPRA

Amended California · In force Jan 1, 2020 · next deadline Jan 1, 2027 (in 2 months)

Official text

Add to calendar

Apple Calendar or Outlook Google Calendar Download .ics

Deadlines

Coming up

ComplianceJan 1, 2027 · in 2 months · Source

ADMT requirements compliance dateBusinesses using ADMT for significant decisions must comply with Article 11 (pre-use notice, opt-out, access rights) by this date (11 CCR 7200(b)).

ComplianceJan 1, 2027 · in 2 months · Source

Browsers must support opt-out preference signal (AB 566)Businesses that develop or maintain a browser must include consumer-configurable functionality to send an opt-out preference signal (Civ. Code 1798.136, operative Jan 1, 2027).

ComplianceDec 31, 2027 · in 14 months · Source

Risk assessments for pre-existing processing dueRisk assessments must be completed and documented for high-risk processing that began before Jan 1, 2026 and continues after (11 CCR 7155(b)).

ReportingApr 1, 2028 · in 17 months · Source

First risk assessment submission to CPPABusinesses must submit required risk assessment information and attestation for assessments conducted in 2026 and 2027 (11 CCR 7157(a)(1)); annually by April 1 thereafter.

ReportingApr 1, 2028 · in 17 months · Source

Cybersecurity audit due: revenue over $100MFirst cybersecurity audit report (covering Jan 1, 2027 - Jan 1, 2028) and certification due for businesses with 2026 annual gross revenue over $100M (11 CCR 7121(a)(1)).

ReportingApr 1, 2029 · in 2.4 years · Source

Cybersecurity audit due: revenue $50M-$100MFirst cybersecurity audit report (covering 2028) due for businesses with 2027 annual gross revenue between $50M and $100M (11 CCR 7121(a)(2)).

ReportingApr 1, 2030 · in 3.4 years · Source

Cybersecurity audit due: revenue under $50MFirst cybersecurity audit report (covering 2029) due for covered businesses with 2028 annual gross revenue under $50M (11 CCR 7121(a)(3)); annual by April 1 thereafter.

Already passed

Takes effectJan 1 · 10 months ago · Source

New CCPA regulations take effectADMT, risk assessment, cybersecurity audit and updated CCPA regulations become effective; risk assessments required for new high-risk processing.

Transition endsSep 22, 2025 · 13 months ago · Source

ADMT, risk assessment and cybersecurity audit regulations approvedOAL approves the CCPA Updates, Cybersecurity Audit, Risk Assessment, ADMT and Insurance regulations and files them with the Secretary of State.

Transition endsJan 1, 2025 · 22 months ago · Source

CPI adjustment of thresholds and finesRevenue threshold rises to $26,625,000 and fines to $2,663 / $7,988 per violation.

Takes effectJan 1, 2023 · 3.8 years ago · Source

CPRA amendments operativeCPRA amendments (correction right, sensitive PI limits, sharing opt-out, employee/B2B data coverage) become operative.

Takes effectJan 1, 2020 · 6.8 years ago · Source

CCPA takes effectOriginal CCPA consumer rights and business obligations take effect.

Summaries for reference, not legal advice. Check the official text.

What it does

Gives California residents (including employees and B2B contacts) rights to know, delete, correct, and opt out of sale/sharing of personal information and to limit use of sensitive personal information. CPPA regulations approved Sept 22, 2025 (effective Jan 1, 2026) add automated decisionmaking technology (ADMT) rights, mandatory risk assessments with submissions to the agency, and annual independent cybersecurity audits. AB 566 (2025) requires browsers to offer an opt-out preference signal from Jan 1, 2027.

Who it applies to: For-profit businesses doing business in California that meet any of: annual gross revenue over $25M as CPI-adjusted ($26,625,000 from Jan 1, 2025); buy, sell or share personal information of 100,000+ consumers or households; or derive 50%+ of annual revenue from selling or sharing personal information. Cybersecurity audits apply to businesses deriving 50%+ revenue from selling/sharing PI, or over the revenue threshold and processing PI of 250,000+ consumers/households or sensitive PI of 50,000+ consumers.
Penalties: Administrative fines/civil penalties up to $2,663 per violation and $7,988 per intentional violation or violation involving minors under 16 (CPI-adjusted from Jan 1, 2025; statutory base $2,500/$7,500). Private right of action for data breaches: $107-$799 per consumer per incident or actual damages. No statutory cure period (the 30-day cure was removed by the CPRA; CPPA may consider cure discretionarily).
Enforced by: California Privacy Protection Agency (CalPrivacy) and California Attorney General
Official name: California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (Cal. Civ. Code 1798.100 et seq.) and CPPA regulations (Cal. Code Regs. tit. 11, 7000 et seq.)
Citation: Cal. Civ. Code 1798.100-1798.199.100 (AB 375, Stats. 2018 ch. 55; Proposition 24 (2020)); 11 CCR 7000 et seq.
Topics: Privacy, AI, Cybersecurity, Children

Verified 2026-09-22 cppa.ca.gov cppa.ca.gov leginfo.legislature.ca.gov cppa.ca.gov alston.com

Research notes

Monetary thresholds are CPI-adjusted every odd year; a January 2027 adjustment is expected but not yet published as of verification. CPPA rebranded as CalPrivacy. Additional 2025 bills (e.g. SB 361 data broker disclosures) and further CPPA rulemaking (reported for late 2026/2027 on notices and employee data) are not captured as deadlines. Risk assessment submission deadline is April 1, 2028 per 11 CCR 7157 (not April 21).

EnactedAlabama

Alabama Personal Data Protection Act (APDPA)Alabama's comprehensive privacy law, enacted April 2026, grants rights to confirm, correct, delete, port and opt out of targeted advertising, sale and profiling. Unusually, it does not require data protection assessments, generally excludes analytics and certain marketing disclosures from 'sale', and broadly exempts small businesses that don't sell data.Next: May 1, 2027 APDPA takes effect · in 6 months

In forceArkansas

Arkansas COPPA 2.0State COPPA-style law that extends protections to teens. Operators of sites and apps directed to children or teens, or with knowledge of their age, face limits on collecting and using their personal information and on targeted advertising.In effect since Jul 1, 2026

In forceCalifornia

California AB 2013 (AI training data transparency)Developers of generative AI systems made publicly available to Californians must post documentation of the training data on their websites. It must cover a high-level summary of the datasets, their sources and owners, the number of data points, the types of data, whether the data includes copyrighted material or personal information, whether it was licensed or purchased, cleaning and processing steps, collection periods, and whether synthetic data was used.In effect since Jan 1, 2026

In forceCalifornia

California ADS employment regulationsClarifies that using an automated-decision system in hiring or other employment decisions can violate the Fair Employment and Housing Act if it discriminates on protected traits. Employers must keep automated-decision data and employment records for at least four years. AI assessments that elicit disability information can be unlawful medical inquiries.In effect since Oct 1, 2025

EnactedCalifornia

California AI Auditor RegistryCreates a state registry for AI auditors run by the Government Operations Agency. From 2029 only registered auditors may offer, sell or conduct covered AI audits, and they must show their registration number in advertising. Registered auditors must file information and follow conduct rules.Next: Jan 1, 2027 Act takes effect · in 2 months

AmendedCalifornia

California AI Transparency Act (SB 942)Covered generative AI providers must offer a free AI-content detection tool, give users the option of a visible (manifest) disclosure on AI-generated image, video or audio, and embed a latent, machine-readable provenance disclosure. Licensees must keep those disclosures intact, and providers must revoke a license within 96 hours of learning a licensee disabled them. AB 853 delayed the operative date to August 2, 2026 and extends duties to large online platforms and GenAI hosting platforms from 2027 and to capture-device makers from 2028.Next: Jan 1, 2027 Large online platform and hosting platform duties · in 2 months

In forceCalifornia

California AI autonomous-harm defense banA defendant that developed, modified or used AI cannot argue in a civil case that the AI acted autonomously and so caused the harm on its own. Other defenses such as causation and comparative fault remain.In effect since Jan 1, 2026

In forceCalifornia

California Delete Act / DROPRequires data brokers to register annually with the California Privacy Protection Agency and to process consumer deletion requests submitted through the agency's Delete Request and Opt-out Platform (DROP). DROP opened to consumers Jan 1, 2026; from Aug 1, 2026 brokers must pull and process requests at least every 45 days. Brokers face independent compliance audits every three years from 2028.Next: Jan 31, 2027 Annual data broker registration deadline · in 3 months

Questions about CCPA / CPRA

What are the CCPA / CPRA compliance deadlines?: Jan 1, 2020: CCPA takes effect. Jan 1, 2023: CPRA amendments operative. Jan 1, 2025: CPI adjustment of thresholds and fines. Sep 22, 2025: ADMT, risk assessment and cybersecurity audit regulations approved. Jan 1, 2026: New CCPA regulations take effect. Jan 1, 2027: ADMT requirements compliance date. Jan 1, 2027: Browsers must support opt-out preference signal (AB 566). Dec 31, 2027: Risk assessments for pre-existing processing due. Apr 1, 2028: First risk assessment submission to CPPA. Apr 1, 2028: Cybersecurity audit due: revenue over $100M. Apr 1, 2029: Cybersecurity audit due: revenue $50M-$100M. Apr 1, 2030: Cybersecurity audit due: revenue under $50M.
When does CCPA / CPRA take effect?: CCPA / CPRA took effect on Jan 1, 2020. The next milestone is Jan 1, 2027: ADMT requirements compliance date.
Who does CCPA / CPRA apply to?: For-profit businesses doing business in California that meet any of: annual gross revenue over $25M as CPI-adjusted ($26,625,000 from Jan 1, 2025); buy, sell or share personal information of 100,000+ consumers or households; or derive 50%+ of annual revenue from selling or sharing personal information. Cybersecurity audits apply to businesses deriving 50%+ revenue from selling/sharing PI, or over the revenue threshold and processing PI of 250,000+ consumers/households or sensitive PI of 50,000+ consumers.
What are the penalties under CCPA / CPRA?: Administrative fines/civil penalties up to $2,663 per violation and $7,988 per intentional violation or violation involving minors under 16 (CPI-adjusted from Jan 1, 2025; statutory base $2,500/$7,500). Private right of action for data breaches: $107-$799 per consumer per incident or actual damages. No statutory cure period (the 30-day cure was removed by the CPRA; CPPA may consider cure discretionarily).

Deadlines

What it does

Related