Cal. Civ. Code §§ 1798.100–1798.199.100 (Division 3, Part 4, Title 1.81.5) · Last verified
CCPA
The CCPA is Cal. Civ. Code §§ 1798.100–1798.199.100; the "business" thresholds and the administrative fine ceiling are reproduced verbatim here. Enacted 28 June 2018 and amended by Proposition 24 (the California Privacy Rights Act of 2020), it is reproduced here in its own wording, with section numbers and source links — this page does not interpret it or assess applicability.
- Citation
- Cal. Civ. Code §§ 1798.100–1798.199.100 (Division 3, Part 4, Title 1.81.5)
- Jurisdiction
- US — California
- Regulator
- California Privacy Protection Agency (administrative enforcement, § 1798.155) and the California Attorney General (civil actions, § 1798.199.90)
- Last verified
What it is
Enacted 28 June 2018 and amended by Proposition 24 (the California Privacy Rights Act of 2020), it is reproduced here in its own wording, with section numbers and source links — this page does not interpret it or assess applicability.
Key dates
- Enacted (AB 375): —
"Approved by Governor June 28, 2018. Filed with Secretary of State June 28, 2018."
- Operative: —
§ 1798.198(a): "...this title shall be operative January 1, 2020."
- Amended by Proposition 24 (California Privacy Rights Act of 2020) — approved: —
leginfo history: "(Added November 3, 2020, by initiative Proposition 24...)"
- Proposition 24 amendments operative: —
Prop 24 SEC. 31(a): "...this act shall become operative January 1, 2023..."
Scope
Cal. Civ. Code § 1798.140(d)(1)(A)–(C) — "business" definition and thresholds
A sole proprietorship, partnership, limited liability company, corporation, association, or other legal entity that is organized or operated for the profit or financial benefit of its shareholders or other owners, that collects consumers’ personal information, or on the behalf of which such information is collected and that alone, or jointly with others, determines the purposes and means of the processing of consumers’ personal information, that does business in the State of California, and that satisfies one or more of the following thresholds:
(A) As of January 1 of the calendar year, had annual gross revenues in excess of twenty-five million dollars ($25,000,000) in the preceding calendar year, as adjusted pursuant to subdivision (d) of Section 1798.199.95.
(B) Alone or in combination, annually buys, sells, or shares the personal information of 100,000 or more consumers or households.
(C) Derives 50 percent or more of its annual revenues from selling or sharing consumers’ personal information.
California Legislative Information — Cal. Civ. Code § 1798.140 (current text) ↗
Penalties
Cal. Civ. Code § 1798.155(a)
Any business, service provider, contractor, or other person that violates this title shall be liable for an administrative fine of not more than two thousand five hundred dollars ($2,500) for each violation or seven thousand five hundred dollars ($7,500) for each intentional violation or violations involving the personal information of consumers whom the business, service provider, contractor, or other person has actual knowledge are under 16 years of age, as adjusted pursuant to subdivision (d) of Section 1798.199.95, in an administrative enforcement action brought by the California Privacy Protection Agency.
How the dollar thresholds are adjusted
§ 1798.199.95(d)(1)
On January 1, 2025, and on January 1 of any odd-numbered year thereafter, the California Privacy Protection Agency shall adjust the monetary thresholds in subparagraph (A) of paragraph (1) of subdivision (d) of Section 1798.140, subparagraph (A) of paragraph (1) of subdivision (a) of Section 1798.150, subdivision (a) of Section 1798.155, Section 1798.199.25, and subdivision (a) of Section 1798.199.90 to reflect any increase in the Consumer Price Index.
Sources
Last verified:
This page is for information only and is not legal advice. It reproduces the regulation's own wording; always confirm against the primary source linked above and consult qualified counsel for how it applies to your organisation.