CCPA/CPRA Compliance Guide (2026): Thresholds, ADMT, Audits and Fines

The **California Consumer Privacy Act (CCPA)**, as amended by the **CPRA** (Proposition 24, effective 1 January 2023), gives California residents a set of privacy rights: - know - delete - correct - opt out of the sale or sharing of their data - limit the use of sensitive data - equal treatment It applies to for-profit businesses that do business in California and meet a revenue or data threshold. The revenue threshold is currently **$26,625,000** ([CPPA](https://www.cppa.ca.gov/regulations/cpi_adjustment.html)). The CCPA is enforced by the **California Privacy Protection Agency (CalPrivacy)** and the Attorney General. Regulations effective **1 January 2026** add: - **risk assessments**, with attestations due 1 April 2028 - **annual cybersecurity audits**, with first certifications due from 1 April 2028 to 2030 depending on revenue - **automated decisionmaking technology (ADMT)** rights, which apply from **1 January 2027** ([CPPA announcement](https://cppa.ca.gov/announcements/2025/20250923.html)) **SB 923**, signed 27 September 2026, expands the right to delete to third-party-sourced data from 1 January 2027. Administrative fines are up to **$2,663 per violation**, or **$7,988** for intentional violations or those involving minors under 16.

By AssureCore Compliance Team · Last reviewed 23 October 2026

Who must comply

According to the CPPA FAQ, a "business" is a for-profit entity that collects consumers' personal information, determines why and how it's processed, does business in California, and meets any one of these thresholds:

gross annual revenue of $26.625 million or more in the preceding calendar year
buys, sells or shares the personal information of 100,000 or more California residents or households
derives 50% or more of annual revenue from selling or sharing personal information

The law also reaches some controlled entities and joint ventures. Service providers, contractors and third parties carry their own obligations.

The exemptions for employee and B2B data expired on 31 December 2022 (OAG). Employees, job applicants and business contacts therefore have full rights.

Key requirements

Consumer rights and response times (OAG)

Request	Deadline
Know / access	45 calendar days, extendable to 90 days with notice. Up to twice a year, free of charge.
Delete	45 calendar days, extendable to 90
Correct, limit sensitive data	Per the regulations
Opt out of sale/sharing	As soon as feasibly possible, at most 15 business days. Global Privacy Control (GPC) signals must be honored.

Other rules from the same source:

You must wait 12 months before asking a consumer to opt back in.
Selling the data of a known under-16 requires opt-in, from a parent if the child is under 13.
Businesses that sell or share data need a "Do Not Sell or Share My Personal Information" link.
You can't make consumers create an account to opt out.

Business obligations

Notice at collection and a privacy policy.
Purpose limitation and data minimization. Collection, use and retention must be "reasonably necessary and proportionate" to purposes consumers would expect, compatible purposes, or purposes they consented to. Consent obtained through dark patterns doesn't count (CPPA FAQ).
Contracts with service providers, contractors and third parties.
Reasonable security. Consumers can sue over certain data breaches.

2026 regulations: risk assessments, cybersecurity audits, ADMT

The Board adopted these on 24 July 2025, and they took effect 1 January 2026 (CPPA regulations).

Risk assessments. Compliance begins 1 January 2026. By 1 April 2028, businesses must submit an attestation and a summary of their risk assessments.
Cybersecurity audit certifications are due to CalPrivacy by:
1 April 2028 if revenue is over $100M
1 April 2029 if revenue is $50M–$100M
1 April 2030 if revenue is under $50M
ADMT used for significant decisions (employment, housing, financial services, education, healthcare) requires the following from 1 January 2027:
pre-use notice
opt-out where applicable
access to meaningful information about the logic (CPPA FAQ)

Coming 1 January 2027: SB 923

The Expanding Privacy Rights Act makes deletion apply to personal information obtained from third parties. It lets businesses keep a suppression list so deleted data stays deleted. Online-only businesses must offer an online request method, such as a web form, and can't offer only an email address (CalPrivacy).

Data brokers

Under the Delete Act (SB 362), data brokers must register by 31 January each year or face daily penalties. The DROP platform has let consumers send one deletion request to all registered brokers since 1 January 2026 (CPPA FAQ; CPPA regulations).

Certification and attestation

There's no CCPA certification. The new regulations instead create regulator submissions:

risk assessment attestations and summaries, from April 2028
cybersecurity audit certifications, from April 2028 to 2030, based on an independent audit

Penalties

These are the CPI-adjusted amounts effective 1 January 2025 (CPPA).

Administrative fines and civil penalties: up to $2,663 per violation, or $7,988 per intentional violation or violation involving the data of consumers known to be under 16.
Data breach private right of action: $107–$799 per consumer per incident, or actual damages if greater.

Thresholds adjust every odd-numbered year. CalPrivacy publicizes enforcement actions, including a $1.35M settlement with a retailer in September 2025 (CPPA announcements).

Mapping to related frameworks

GDPR / UK GDPR:
access, deletion and correction rights correspond closely
risk assessments correspond to DPIAs
ADMT rules correspond to GDPR Art. 22
Other US state laws: SB 923 aligns deletion with Delaware, Indiana, Maryland and New Jersey.
SOC 2 / ISO 27001 / NIST CSF: provide control evidence for the cybersecurity audit.
NIST Privacy Framework: useful for structuring risk assessments.

Readiness checklist

Test the thresholds, including the $26.625M revenue figure and the 100,000-consumer count.
Map your personal and sensitive personal information, including employee and B2B data.
Publish a notice at collection, a privacy policy, and a "Do Not Sell or Share" link. Honor GPC signals.
Build request workflows: 45-day and 15-business-day SLAs, verification, and authorized agents.
Update service provider and contractor contracts.
Inventory processing that requires risk assessments, start them now, and plan the April 2028 attestation.
Scope the cybersecurity audit and pick your deadline tier.
Inventory ADMT used for significant decisions before 1 January 2027.
Prepare for SB 923: delete third-party-sourced data, keep a suppression list, and add a web form.
Check whether you meet the data broker definition and need to register.

Common pitfalls

Assuming employee data is exempt. That exemption ended in 2022.
Ignoring GPC signals.
Using dark patterns in consent or opt-out flows.
Treating the 2028 audit date as the start date. Risk assessment compliance began in January 2026.
Deleting only data collected directly from the consumer once SB 923 takes effect.

How AssureCore helps

The Controls Register and Cross-framework Mapping connect CCPA cybersecurity audit areas to the SOC 2 and ISO 27001 controls you already run.
The Risk Register supports risk assessment records.
Policy Management drafts and gap-checks privacy policies.
Evidence Management (with expiry alerts) and Audit Reports (PDF/CSV) prepare attestation evidence.

Frequently asked questions

What is the CCPA revenue threshold in 2026?

$26,625,000 in gross annual revenue for the preceding year, effective 1 January 2025. The next CPI adjustment is due 1 January 2027.

Is the CPRA a separate law from the CCPA?

No. The CPRA amended the CCPA. Regulators refer to it as the "CCPA, as amended."

When are CCPA cybersecurity audits due?

The first certifications are due 1 April 2028 for revenue over $100M, 1 April 2029 for $50–100M, and 1 April 2030 for under $50M.

When do the ADMT rules apply?

From 1 January 2027, for businesses that use ADMT to make significant decisions about consumers.

What are the CCPA fines?

Up to $2,663 per violation, or $7,988 per intentional violation or violation involving minors under 16.

What does SB 923 change?

From 1 January 2027, deletion covers data a business got from third parties, and online-only businesses must offer an online request form.

Does the CCPA cover employee data?

Yes. The employee and B2B exemptions expired on 31 December 2022.

Official references

Supporting evidence and assessment preparation

Evidence examples

Keep approved policies, scope decisions, risk records and operating evidence linked to accountable owners. Record the source, period covered, review and exceptions.

Assessment preparation

Review the applicable requirements and evidence with their owners. Reconcile gaps, findings and action plans, and prepare a clear scope narrative and evidence index.

Common failure points

Avoid treating a framework as a one-time checklist, collecting evidence without context, or leaving decisions and corrective actions undocumented.

Explore workspace guidance or browse other framework guides.