California

Cal. Civ. Code § 1798.100 et seq. (CCPA as amended by CPRA)

Unverified secondary source. The values below were summarised from a secondary legal tracker, captured 11 Sep 2026, and have not yet been independently verified against the primary statute text. Figures such as thresholds may have been amended or adjusted since. Check the statute and the regulator's current guidance before relying on any value. Not legal advice.

Applicability

  • Consent model: Opt-out (processing allowed until the consumer opts out)
  • Consumer threshold: 100,000
  • Revenue threshold: $25,000,000

Enforcement

  • Regulator: California Privacy Protection Agency (CPPA) / Attorney General
  • DSAR response window: 45 days
  • Cure period: None — no opportunity to cure

Global Privacy Control (GPC)

Mandatory to honor as of 2023-01-01.

The information provided is for educational and comparison purposes only and does not constitute formal legal advice.

Sourced from a secondary legal tracker (not yet independently verified against primary statute text), captured 11 Sep 2026. Source: https://www.consenteo.com/knowledge-hub/legal/us_state_privacy_law_tracker_2026.