California Consumer Privacy Act (CCPA)

Complete Guide for Consumers & Businesses — including CPRA amendments.

Version 2.0 (January 2026)Last Updated: January 29, 2026Status: Includes CPRA amendments35+ comprehensive pages

Download Instructions

To access the complete guide:

Click the download icon (⬇️) in the toolbar above
The CCPA_Complete_Guide_2026.pdf file will open or download directly from the server.
You can save the PDF to your device for offline reference.
If you need an editable version, you can convert the PDF to Word or another supported format.

01Executive Summary
02What is CCPA?
03Consumer Rights Guide
04Business Compliance Guide
05Definitions & Key Terms
06How to Exercise Your Rights
07Business Obligations Checklist
08Enforcement & Penalties
09FAQs
10Quick Reference Cards

1. Executive Summary

The California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), is the most comprehensive state privacy law in the United States. It grants California residents meaningful control over their personal information and imposes significant obligations on businesses that collect, use, sell, or share that information.

This guide explains what the law requires, the rights it gives consumers, and the steps businesses must take to comply — including the CPRA amendments that took effect on January 1, 2023 and the regulations issued by the California Privacy Protection Agency (CPPA).

2. What is CCPA?

The CCPA (Cal. Civ. Code §1798.100 et seq.) took effect on January 1, 2020. It applies to for-profit businesses that do business in California and meet at least one of the following thresholds:

Annual gross revenue exceeding $25 million;

Buy, sell, or share the personal information of 100,000 or more consumers or households; or

Derive 50% or more of annual revenue from selling or sharing consumers' personal information.

“Personal information” is defined broadly: information that identifies, relates to, or could reasonably be linked with a particular consumer or household — including identifiers, commercial information, internet activity, geolocation, professional information, and inferences.

3. Consumer Rights Guide

Right to Know

You can request that a business disclose the categories and specific pieces of personal information it has collected about you, the sources of that information, the business purpose for collecting it, and the third parties with whom it is shared.

Right to Delete

You can request that a business delete personal information it has collected from you, subject to certain exceptions (e.g., completing a transaction, security, legal compliance).

Right to Opt-Out of Sale / Sharing

You can direct a business to stop selling or sharing your personal information, including sharing for cross-context behavioral advertising. Businesses must honor Global Privacy Control (GPC) signals.

Right to Correct

Added by the CPRA: you can request that a business correct inaccurate personal information it maintains about you.

Right to Limit Use of Sensitive PI

You can direct a business to limit its use of sensitive personal information (e.g., SSN, precise geolocation, health data) to what is necessary to provide the goods or services you requested.

Right to Non-Discrimination

A business cannot discriminate against you — through pricing, service levels, or quality — for exercising any of your CCPA rights.

4. Business Compliance Guide

Compliance is an ongoing program, not a one-time project. At a minimum, covered businesses should:

Map data flows — know what personal information you collect, where it lives, and who receives it.

Update public-facing notices (notice at collection, privacy policy, opt-out links).

Stand up intake, verification, and fulfillment workflows for consumer requests.

Review and update service-provider and third-party contracts.

Implement reasonable security and a documented retention schedule.

Train staff and keep auditable records of requests and responses.

StewardIQ’s data governance platform helps operationalize each of these steps — from data mapping and lineage to request workflows and audit-ready evidence.

5. Definitions & Key Terms

Personal Information (PI): Information that identifies, relates to, or could reasonably be linked with a consumer or household.
Sensitive Personal Information: SSN, financial account credentials, precise geolocation, race/ethnicity, health data, biometric data, and similar categories.
Sale: Disclosing PI to a third party for monetary or other valuable consideration.
Sharing: Disclosing PI for cross-context behavioral advertising, whether or not for money.
Service Provider: A vendor that processes PI on behalf of a business under a written contract restricting its use.
Global Privacy Control (GPC): A browser-level opt-out signal businesses must honor as a valid opt-out request.
CPPA: The California Privacy Protection Agency — the regulator created by the CPRA to enforce the law.

6. How to Exercise Your Rights

Submit a request through the business's designated methods (webform, toll-free number, or email).
Verify your identity — businesses may ask for information proportionate to the sensitivity of the data.
The business must respond within 45 days, with one permitted 45-day extension upon notice.
If your request is denied, you may appeal, and you may file a complaint with the CPPA or the California Attorney General.

To exercise your rights with respect to StewardIQ, email privacy@stewardiq.com or visit our contact page.

7. Business Obligations Checklist

Provide a clear 'Notice at Collection' describing categories of personal information collected and purposes of use.

Maintain an up-to-date privacy policy describing consumer rights and how to exercise them.

Offer at least two methods for submitting requests (including a toll-free number where applicable).

Provide a conspicuous 'Do Not Sell or Share My Personal Information' link on your homepage.

Honor Global Privacy Control (GPC) opt-out preference signals.

Verify consumer requests proportionate to the sensitivity of the data.

Respond to verified requests within 45 days (extendable once by 45 days with notice).

Train employees who handle consumer requests on CCPA requirements.

Maintain records of consumer requests and responses for at least 24 months.

Enter into contracts with service providers and third parties that restrict use of personal information.

Implement reasonable security procedures and practices to protect personal information.

Conduct risk assessments and cybersecurity audits where required by CPRA regulations.

8. Enforcement & Penalties

$2,500

Civil penalty per violation (non-intentional).

$7,500

Per intentional violation or violations involving minors.

$100–$750

Statutory damages per consumer per data-breach incident (private right of action).

Enforcement is handled by the California Privacy Protection Agency (CPPA) and the California Attorney General. The CPRA removed the automatic 30-day cure period — curing is now at the CPPA’s discretion.

9. FAQs

Who does the CCPA apply to?

For-profit businesses doing business in California that meet at least one threshold: annual gross revenue over $25 million; buy, sell, or share personal information of 100,000+ consumers or households; or derive 50% or more of annual revenue from selling or sharing consumers' personal information.

What is the difference between CCPA and CPRA?

The CPRA (California Privacy Rights Act, effective January 1, 2023) amended and expanded the CCPA. It added the rights to correct and to limit sensitive personal information, created the California Privacy Protection Agency (CPPA), and extended obligations to 'sharing' for cross-context behavioral advertising.

Does CCPA apply to employee and B2B data?

Yes. Since January 1, 2023, the CPRA removed the prior exemptions, so personal information of employees, job applicants, and B2B contacts is fully covered.

How much can violations cost?

Civil penalties of up to $2,500 per violation, or $7,500 per intentional violation or violations involving minors. Consumers also have a private right of action for certain data breaches, with statutory damages of $100–$750 per consumer per incident.

Is there a cure period for violations?

No. The CPRA removed the automatic 30-day cure period; the CPPA has discretion to allow curing depending on the circumstances.

How do I submit a request to StewardIQ?

Contact us at privacy@stewardiq.com or use the contact page. We will verify your identity and respond within the timeframes required by law.

10. Quick Reference Cards

For Consumers

You have the right to know, delete, correct, opt out, limit sensitive PI, and non-discrimination.
Businesses must respond within 45 days.
Use Global Privacy Control to opt out automatically.
Complaints go to the CPPA or the California AG.

For Businesses

Applies if you meet revenue, volume, or revenue-share thresholds.
Notices, opt-out links, and GPC support are mandatory.
Keep request records for 24 months.
Penalties up to $7,500 per intentional violation — no automatic cure period.

Disclaimer

This guide is provided for informational purposes only and does not constitute legal advice. Consult qualified counsel for advice on your specific obligations. See also our Privacy Policy and Terms of Service.

Operationalize CCPA compliance with StewardIQ

Map data, manage consumer requests, and keep audit-ready evidence — all in one governed platform.