California (US)
Full entry AI-checked Checked 5 November 2026
Read this together with United States (federal), which also applies.
| Law | Citation | Status | In force from |
|---|---|---|---|
| California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA) | Cal. Civil Code §§ 1798.100–1798.199.100 | In force | 1 January 2020 |
| CCPA Regulations | Cal. Code Regs., tit. 11, § 7000 et seq. | In force | 29 March 2023 |
| Delete Act (data broker registration and deletion) | Cal. Civil Code §§ 1798.99.80–1798.99.89 (SB 362, 2023) | In force | 1 January 2024 |
| Data breach notification law | Cal. Civil Code § 1798.82 (businesses), amended by SB 446 (Stats. 2025, ch. 319) | In force | 1 July 2003 |
| California Age-Appropriate Design Code Act | Cal. Civil Code §§ 1798.99.28–1798.99.40 (AB 2273, Stats. 2022, ch. 320) | In force | 1 July 2024 |
| Protecting Our Kids from Social Media Addiction Act | Cal. Health & Safety Code § 27000 et seq. (SB 976, 2024) | In force | 1 January 2025 |
| Digital Age Assurance Act | Cal. Civil Code § 1798.500 et seq. (AB 1043, Stats. 2025, ch. 675; amended by AB 1856, Stats. 2026, ch. 184) | Enacted, not yet in force | 1 January 2027 |
| Companion chatbots law | Cal. Bus. & Prof. Code § 22601 et seq. (SB 243, Stats. 2025, ch. 677) | In force | 1 January 2026 |
| Companion chatbots and children’s safety (Adam’s Law) | Cal. Bus. & Prof. Code § 21810 et seq. (SB 1119, Stats. 2026, ch. 190) | Enacted, not yet in force | 1 July 2027 |
| Online services likely to be accessed by children (revised design code) | Cal. Civil Code § 1798.99.28 et seq. (AB 2246, Stats. 2026, ch. 187) | Enacted, not yet in force | 1 January 2027 |
| Covered platforms age restriction | Cal. Bus. & Prof. Code §§ 22682–22686 (AB 1709, Stats. 2026, ch. 183) | Enacted, not yet in force | 1 January 2027 |
- California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA): The CPRA (Proposition 24) amendments apply from 1 January 2023. The link is CalPrivacy’s copy of the text in force on 1 January 2026. A duty for browsers to offer an opt-out preference signal starts on 1 January 2027.
- CCPA Regulations: Amended from 1 January 2026 with rules on risk assessments, cybersecurity audits and automated decisionmaking technology that phase in up to 2030. CalPrivacy’s board is due to consider, on 6 November 2026, starting formal rulemaking on further opt-out preference signal rules.
- Delete Act (data broker registration and deletion): CalPrivacy runs the data broker registry and the Delete Request and Opt-out Platform (DROP), open to consumers since 1 January 2026.
- Data breach notification law: SB 446 added fixed notice deadlines from 1 January 2026.
- California Age-Appropriate Design Code Act: A federal court blocked it in full in 2023, before it took effect, and again on remand. Since the Ninth Circuit’s 12 March 2026 ruling only some provisions stay blocked, and the case continues in the district court. AB 2246 repeals and replaces it on 1 January 2027.
- Protecting Our Kids from Social Media Addiction Act: Its like-count default, notification limits and annual disclosure duty are enjoined. Age assurance applies from 1 January 2027 under Attorney General regulations, proposed in May 2026.
- Digital Age Assurance Act: From 1 January 2027 operating systems with an account setup ask for the user’s age and send age-bracket signals to app stores and developers that request them. AB 1856 (Stats. 2026, ch. 184) amended it before it starts and bars requesting a signal unless a law requires it. Fines up to $2,500 per affected child, or $7,500 if intentional, in Attorney General suits.
- Companion chatbots law: Operators must disclose that the bot is artificial and have protocols for users who express suicidal thoughts or self-harm. From 1 January 2027 SB 1119 removes its separate duties for users known to be minors.
- Companion chatbots and children’s safety (Adam’s Law): Mostly from 1 July 2027. Operators must check age through the Digital Age Assurance Act or give every user the child protections. Before launching or substantially changing a companion chatbot they must assess and reduce risks to under-18s, and children’s use needs crisis protocols, parent-controlled defaults and no behavioural ads. Independent child safety audits are due by 1 January 2029, or before launch if later. Public prosecutors can seek up to $15,000 per affected child for intentional breaches, and a child harmed by certain breaches can sue.
- Online services likely to be accessed by children (revised design code): Repeals and replaces the 2022 design code from 1 January 2027, without its impact-assessment duty. Services likely to be accessed by under-18s must estimate age or protect all users, set high-privacy defaults, limit profiling, precise geolocation and dark patterns, and take reasonable steps against listed harms. Fines up to $5,000 per affected child, or $15,000 if intentional, in suits by the Attorney General or public prosecutors.
- Covered platforms age restriction: From 1 January 2027, covered platforms may not give under-16s addictive feeds, autoplay or other addictive features the Attorney General defines, must check age through the Digital Age Assurance Act first, and must delete under-16 accounts unless no addictive features are offered. Fines up to $50,000 per affected minor if knowing, $25,000 if negligent, in suits by the Attorney General or local prosecutors only.
Regulators
Section titled “Regulators”What builders must do
Section titled “What builders must do”Who it covers
Section titled “Who it covers”The CCPA covers for-profit businesses doing business in California that collect residents’ personal data and meet one test, revenue over $26,625,000 a year (2025 figure), buying, selling or sharing data on 100,000 or more consumers or households a year, or half their revenue from selling or sharing it. It covers employee, applicant and B2B data. HIPAA, GLBA and FCRA data are largely exempt; non-profits generally aren’t covered. Apps keeping users’ medical information, mental or reproductive health digital services and, from 2027, health chatbots fall under the medical privacy law (CMIA).
Sources: cppa.ca.gov/pdf/20260101_ccpa_statute.pdf · cppa.ca.gov/regulations/cpi_adjustment.html · oag.ca.gov/privacy/ccpa · oag.ca.gov/privacy/privacy-laws · leginfo.legislature.ca.gov/faces/billNavClient.xhtml
Lawful bases
Section titled “Lawful bases”No GDPR-style lawful bases. Give notice at or before collection, keep collection and use reasonably necessary and proportionate, and honour rights to know, delete, correct, opt out of sale or sharing, and limit use of sensitive data. There’s no opt-in for sensitive data. Don’t penalise people for using their rights. Whatever their size, sites and apps collecting Californians’ data must post a privacy policy (CalOPPA). From 1 January 2027 (SB 923) deletion covers data collected about a person from any source, and online-only businesses must offer a web form or portal for requests.
Sources: cppa.ca.gov/pdf/20260101_ccpa_statute.pdf · oag.ca.gov/privacy/ccpa · oag.ca.gov/privacy/privacy-laws · leginfo.legislature.ca.gov/faces/billNavClient.xhtml · cppa.ca.gov/meetings/materials/20260806_07_12_1791b7.pdf · cppa.ca.gov/meetings/materials/20261105_06_05_leg_update.pdf
Consent age for online services
Section titled “Consent age for online services”A business can’t sell or share the data of a consumer it knows is under 16 without opt-in consent, from the consumer if 13 to 15 or from a parent if under 13. Wilfully disregarding age counts as knowing it. From 1 January 2027 the Digital Age Assurance Act has operating systems send age-bracket signals that developers must request and treat as actual knowledge of a user’s age.
Sources: cppa.ca.gov/pdf/20260101_ccpa_statute.pdf · cppa.ca.gov/regulations/pdf/ccpa_statute_eff_20260101.pdf · leginfo.legislature.ca.gov/faces/billNavClient.xhtml · leginfo.legislature.ca.gov/faces/billNavClient.xhtml · apcp.assembly.ca.gov/media/1140
Children
Section titled “Children”The 2022 Age-Appropriate Design Code is partly in effect. After the Ninth Circuit’s March 2026 ruling its impact-assessment, data-use, dark-pattern, policy-enforcement and 90-day cure provisions stay blocked, while age estimation and high-privacy defaults are not; the case continues. AB 2246 replaces it on 1 January 2027. SB 976 bars addictive feeds for minors without parental consent; courts have declined to block that, and appeals are pending. From 2027 AB 1709 bans addictive features for under-16s, and from 1 July 2027 SB 1119 adds child-safety rules for companion chatbots.
Sources: cdn.ca9.uscourts.gov/datastore/opinions/2026/03/12/25-2366.pdf · cdn.ca9.uscourts.gov/datastore/opinions/2025/09/09/25-146.pdf · govinfo.gov/content/pkg/USCOURTS-cand-5_25-cv-09789/pdf/USCOURTS-cand… · oag.ca.gov/sb976 · leginfo.legislature.ca.gov/faces/billNavClient.xhtml · leginfo.legislature.ca.gov/faces/billNavClient.xhtml · leginfo.legislature.ca.gov/faces/billNavClient.xhtml
Leads, not sources: cooley.com/news/insight/2026/2026-03-30-netchoice-v-bonta-ninth-circu…
Cookies and similar technologies
Section titled “Cookies and similar technologies”No cookie-consent rule. People can opt out of “sharing” for cross-context behavioural advertising. A business that sells or shares data must treat an opt-out preference signal such as Global Privacy Control as a valid opt-out and, since 1 January 2026, show whether it honoured it. From 1 January 2027 browsers must offer such a signal, and apps and operating systems may not undo a user’s privacy settings without consent (AB 2561). Also from then, only the Attorney General can sue over pen-register or trap-and-trace claims about website or app tracking (SB 690); wiretap claims remain.
Sources: cppa.ca.gov/regulations/pdf/ccpa_statute_eff_20260101.pdf · cppa.ca.gov/regulations/pdf/20230329_final_regs_text.pdf · cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf · cppa.ca.gov/pdf/20260101_ccpa_statute.pdf · oag.ca.gov/privacy/ccpa · leginfo.legislature.ca.gov/faces/billNavClient.xhtml · leginfo.legislature.ca.gov/faces/billNavClient.xhtml · cppa.ca.gov/meetings/materials/20261105_06_05_leg_update.pdf · apcp.assembly.ca.gov/media/1212
Electronic marketing
Section titled “Electronic marketing”Email, texts and calls rely mainly on federal CAN-SPAM and the TCPA (see us-federal). The CCPA opt-out of selling or sharing also reaches marketing data flows. Under the Shine the Light law (Civil Code 1798.83), a business that gives customers’ personal information to others for their direct marketing must, on request, say what it shared and with whom, or offer a free opt-out. Sites and apps directed to minors can’t market products minors can’t legally buy.
Sources: oag.ca.gov/privacy/privacy-laws · oag.ca.gov/privacy/ccpa
Breach notification
Section titled “Breach notification”Since 1 January 2026, notify affected California residents within 30 calendar days of discovering or being told of a breach of their unencrypted personal information, subject to delays for law enforcement or to determine the scope and restore the system. If more than 500 residents are notified, send the Attorney General a sample notice within 15 days of notifying them. A business holding data it doesn’t own must tell the owner immediately after discovery.
Sources: leginfo.legislature.ca.gov/faces/billNavClient.xhtml · oag.ca.gov/privacy/databreach/reporting · apcp.assembly.ca.gov/media/1026 · apcp.assembly.ca.gov/media/971
Leads, not sources: mvalaw.com/data-points/california-amends-data-breach-notification-req…
Registration and fees
Section titled “Registration and fees”Data brokers, businesses that sell data about consumers they have no direct relationship with, must register with CalPrivacy each January and pay a fee ($6,000 for 2026); one that starts mid-year registers the next January but meanwhile pays a DROP access fee. Since 1 August 2026 they must check DROP at least every 45 days and delete matching data, and every 30 days from 1 January 2027 (AB 883). Missing registration costs $200 a day, and so does each unprocessed deletion request. Independent audits start in 2028.
Sources: cppa.ca.gov/data_brokers · cppa.ca.gov/regulations/pdf/data_broker_reg_delete_act_statute_eff_20… · leginfo.legislature.ca.gov/faces/billNavClient.xhtml · privacy.ca.gov/data-brokers · privacy.ca.gov/drop
Data protection officer
Section titled “Data protection officer”No data protection officer requirement. Under the 2026 regulations, a member of executive management must certify completed cybersecurity audits and submit risk assessment information to CalPrivacy, and audit reports go to the executive responsible for cybersecurity.
Sources: cppa.ca.gov/regulations/pdf/ccpa_statute_eff_20260101.pdf
International transfers
Section titled “International transfers”State law doesn’t restrict transfers outside the US. Disclosures to service providers, contractors and third parties need contracts with set terms, such as specified purposes and the right to check compliance. Federal rules on foreign adversaries are in us-federal.
Sources: cppa.ca.gov/regulations/pdf/ccpa_statute_eff_20260101.pdf
Impact assessments
Section titled “Impact assessments”Since 1 January 2026, do a risk assessment before selling or sharing data, processing sensitive data, using automated decisionmaking technology for significant decisions, making certain automated inferences about workers, students or people in sensitive locations, or training such technology. Assess processing already under way by 31 December 2027 and send a summary and attestation to CalPrivacy by 1 April 2028. Businesses over the audit thresholds also need annual cybersecurity audits, first certified on 1 April 2028, 2029 or 2030 by revenue.
Sources: cppa.ca.gov/regulations/pdf/ccpa_statute_eff_20260101.pdf · cppa.ca.gov/announcements/2025/20250923.html
Automated decisions and AI
Section titled “Automated decisions and AI”From 1 January 2027, businesses using automated decisionmaking technology for significant decisions about finance, housing, education, employment or healthcare must give a pre-use notice, an opt-out or human appeal, and access to how it was used. Since 1 October 2025 Civil Rights Council rules apply anti-discrimination law to automated decision systems in employment, and from 1 July 2027 SB 947 bars employers relying solely on them to discipline or fire. SB 243 and SB 1119 cover companion chatbots, AB 2013 training-data disclosures and SB 53 frontier AI developers.
Sources: cppa.ca.gov/regulations/pdf/ccpa_statute_eff_20260101.pdf · cppa.ca.gov/announcements/2025/20250923.html · calcivilrights.ca.gov/2025/06/30/civil-rights-council-secures-approva… · leginfo.legislature.ca.gov/faces/billNavClient.xhtml · leginfo.legislature.ca.gov/faces/billNavClient.xhtml · apcp.assembly.ca.gov/media/1026 · cppa.ca.gov/meetings/materials/20261105_06_05.pdf · cppa.ca.gov/meetings/materials/20261105_06_05_leg_update.pdf · cppa.ca.gov/meetings/materials/20260806_07_12_1791b7.pdf
Penalties
Section titled “Penalties”CalPrivacy (administrative fines) and the Attorney General (civil suits) enforce the CCPA, up to $2,663 per violation or $7,988 if intentional or involving known under-16s (2025 adjusted figures). There’s no right to cure, though CalPrivacy may allow time to cure. The only private right of action is for breaches caused by unreasonable security, at $107 to $799 per consumer per incident or actual damages, after 30 days’ notice to cure for statutory damages.
Sources: cppa.ca.gov/regulations/cpi_adjustment.html · cppa.ca.gov/pdf/20260101_ccpa_statute.pdf · oag.ca.gov/privacy/ccpa
History
Section titled “History”| Date | Change |
|---|---|
| 5 November 2026 | First entry. Checked against official sources with AI assistance, then corrected after an independent AI-assisted review. |
Report a change
Section titled “Report a change”If a law, a date or a figure here has changed, open an issue with the official source. The data lives in laws/full/us-ca.yaml.