← Global Privacy Laws Research Library
California Consumer Privacy Act of 2018
California Consumer Privacy Act of 2018: CCPA
Prepared by Shubhank Suman · Last reviewed
Current. The CPPA identifies the current CCPA and regulations as effective January 1, 2026. (California Privacy Protection Agency)
- Legal character
- State statute, substantially amended by the CPRA
- Region
- North America
What it covers
The California Consumer Privacy Act of 2018 (CCPA) is a comprehensive privacy law that grants California consumers rights over their personal information and imposes obligations on businesses that collect, use, disclose, or sell personal data. The CCPA provides consumers with rights including access, deletion, correction, opt-out of sale or sharing of personal information, and protection against discrimination for exercising privacy rights. The law establishes transparency, notice, accountability, and data governance requirements for covered businesses and is enforced by the California Privacy Protection Agency (CPPA) and the California Attorney General.
AI, privacy and cybersecurity relevance
- AI: Very High
- Privacy: Very High
- Cyber: Very High
AI
Very High in the current regulatory framework
The CCPA's AI significance is much stronger in the 2026 regulations than the original 2018 Act.
The CPPA's current rules address:
- Automated Decisionmaking Technology (ADMT)
- risk assessments
- cybersecurity audits.
The CPPA states that these regulations became effective 1 January 2026. (California Privacy Protection Agency)
The current regulation contains Article 11: Automated Decisionmaking Technology.
Section 7200 addresses when use of ADMT for a significant decision is subject to the Article. The rules provide additional time for certain pre-existing ADMT uses, with compliance required no later than 1 January 2027 for specified uses. (California Privacy Protection Agency)
Privacy
Very High
Key statutory areas include:
§1798.100: collection/use/disclosure and security §1798.105: deletion §1798.106: correction §1798.110: access §1798.115: disclosure/access §1798.120: sale/sharing opt-out §1798.121: sensitive personal information §1798.130: notice/consumer-response procedures §1798.140: definitions §1798.145 onward: exemptions and enforcement framework.
Cybersecurity
Very High
The current regulatory package includes mandatory requirements for specified businesses to conduct:
annual cybersecurity audits
and risk assessments. (California Privacy Protection Agency)
Applicability
Coverage is threshold-based and includes statutory exclusions.
Current validity
CURRENT: 2026 framework
Read first
§§1798.100, 105, 106, 110, 115, 120, 121, 140 → current CCPA Regulations → Risk Assessment rules → Cybersecurity Audit rules → ADMT rules.
Provisions / sections covered
Important classification
Your site currently has a separate entry for CPRA at No. 7.
Therefore, do not imply that No. 35 and No. 7 are two unrelated California privacy laws.
The accurate relationship is:
CCPA 2018 + CPRA 2020 amendments + current CCPA Regulations
Subject-matter tags
- Sensitive data
- Erasure and deletion
- Automated decision-making
- Cross-border transfers
- Data protection officer
- Enforcement and penalties
- Transparency
- AI cybersecurity
- Accountability
Subject-matter tags describe what the indexed text discusses. They are not legal conclusions.
Related instruments in this library
Document page in the Knowledge Base - full text or PDF where it is available for this record.
This library locates primary and official sources. It does not interpret the law and it is not legal advice.