CCPA and CPRA
California's privacy law. It gives residents rights over their data, expanded by the CPRA in 2023, and lets them sue after certain data breaches.
Also called: California Consumer Privacy Act, California Privacy Rights Act, Prop 24
California's privacy law. It gives residents rights over their data, expanded by the CPRA in 2023, and lets them sue after certain data breaches.
What it means
The CCPA is the California Consumer Privacy Act, a state law enacted in 2018. It gives California residents rights over the personal information that businesses collect. You can ask what is collected, ask to have it deleted, and opt out of its sale or sharing. A business cannot treat you worse for using those rights. The CPRA is the California Privacy Rights Act, a 2020 ballot measure (Proposition 24) that amended the CCPA. Its changes began January 1, 2023. They added rights to correct data and to limit use of sensitive information.
The California Attorney General and the California Privacy Protection Agency enforce most of the law. You generally cannot sue for ordinary violations.
Data breaches are the exception. Suppose certain unencrypted personal information is stolen because a business failed to keep reasonable security. A California resident can sue after giving the business 30 days' written notice. Statutory damages are $107 to $799 per consumer per incident, or actual damages if higher. That range was adjusted for inflation on January 1, 2025.
What it means for you
For you, the CCPA means you can ask many companies what they hold on you. You can tell them to delete it, or to stop selling or sharing it. Browser signals such as Global Privacy Control can opt you out automatically. For settlements, the breach right matters most. Some data breach settlements give a California group an extra payment because of it. If you lived in California when your data was taken, check whether your notice mentions a California subclass or a higher amount.
Example
Say a hypothetical online retailer suffers a breach that exposes unencrypted names and card numbers because of weak security. A California customer sends the company a written notice describing the problem. If the company cannot or does not fix it within 30 days, she could sue under the CCPA's breach provision, alone or in a class action. Later, a settlement might give California members an extra payment on top of the share everyone else gets.
FAQ
Only in one situation: a data breach caused by the company's failure to keep reasonable security. For other violations, such as ignoring a deletion request, only the California Attorney General or the California Privacy Protection Agency can take legal action. You can still report problems to them.
The CCPA protects California residents. Other states have their own privacy laws, and their rights differ.
Related terms
- California Attorney General: California Consumer Privacy Act (CCPA)
- California Privacy Protection Agency: updated monetary thresholds (effective January 1, 2025)
- California Privacy Protection Agency: CCPA statute text, Civil Code 1798.150
Updated Oct 18, 2026. Plain-English definitions for general information — not legal or tax advice.