CCPA-CPRA
California Consumer Privacy Act of 2018 (as amended by CPRA)
- I. California Consumer Privacy Act of 2018 (CCPA/CPRA)
- Ch. I — California Consumer Privacy Act (Cal. Civ. Code 1798.100-1798.199.100)
- Art. 1798.100. General Duties of Businesses that Collect Personal Information (15)
- Art. 1798.105. Consumers’ Right to Delete Personal Information (9)
- Art. 1798.106. Consumers’ Right to Correct Inaccurate Personal Information (3)
- Art. 1798.110. Consumers’ Right to Know What Personal Information is Being Collected. Right to Access Personal Information (10)
- Art. 1798.115. Consumers’ Right to Know What Personal Information is Sold or Shared and to Whom (6)
- Art. 1798.120. Consumers’ Right to Opt Out of Sale or Sharing of Personal Information (6)
- Art. 1798.121. Consumers’ Right to Limit Use and Disclosure of Sensitive Personal Information (4)
- Art. 1798.125. Consumers’ Right of No Retaliation Following Opt Out or Exercise of Other Rights (11)
- Art. 1798.130. Notice, Disclosure, Correction, and Deletion Requirements (28)
- Art. 1798.135. Methods of Limiting Sale, Sharing, and Use of Personal Information and Use of Sensitive Personal Information (20)
- Art. 1798.136. Untitled (3)
- Art. 1798.140. Definitions (21)
- Art. 1798.145. Exemptions (12)
- Art. 1798.146. Untitled (6)
- Art. 1798.148. Untitled (6)
- Art. 1798.150. Personal Information Security Breaches (4)
- Art. 1798.155. Administrative Enforcement (3)
- Art. 1798.160. Consumer Privacy Fund (14)
- Art. 1798.175. Conflicting Provisions (3)
- Art. 1798.180. Preemption (1)
- Art. 1798.185. Regulations (31)
- Art. 1798.190. Anti-Avoidance (2)
- Art. 1798.192. Waiver (5)
- Art. 1798.194. This title shall be liberally construed to effectuate its purposes. ref
- Art. 1798.196. This title is intended to supplement federal and state law, if permissible, but shall not apply if such application is preempted by, or in conflict with, federal law or the United States or California Constitution. ref
- Art. 1798.198. Untitled (2)
- Art. 1798.199. Notwithstanding Section 1798.198, Section 1798.180 shall be operative on the effective date of the act adding this section. ref
- Art. 1798.199.10. Untitled (8)
- Art. 1798.199.15. Members of the agency board shall: (7)
- Art. 1798.199.20. Members of the agency board, including the chairperson, shall serve at the pleasure of their appointing authority but shall serve for no longer than eight consecutive years. ref
- Art. 1798.199.25. For each day on which they engage in official duties, members of the agency board shall be compensated at the rate of one hundred dollars ($100), adjusted pursuant to subdivision (d) of Section 1798.199.95, and shall be reimbursed for expenses incurred in performance of their official duties. ref
- Art. 1798.199.30. The agency board shall appoint an executive director who shall act in accordance with agency policies and regulations and with applicable law. The agency shall appoint and discharge officers, counsel, and employees, consistent with applicable civil service laws, and shall fix the compensation of employees and prescribe their duties. The agency may contract for services that cannot be provided by its employees. ref
- Art. 1798.199.35. The agency board may delegate authority to the chairperson or the executive director to act in the name of the agency between meetings of the agency, except with respect to resolution of enforcement actions and rulemaking authority. ref
- Art. 1798.199.40. The agency shall perform the following functions: (15)
- Art. 1798.199.45. Untitled (4)
- Art. 1798.199.50. No finding of probable cause to believe this title has been violated shall be made by the agency unless, at least 30 days prior to the agency’s consideration of the alleged violation, the business, service provider, contractor, or person alleged to have violated this title is notified of the violation by service of process or registered mail with return receipt requested, provided with a summary of the evidence, and informed of their right to be present in person and represented by counsel at any proceeding of the agency held for the purpose of considering whether probable cause exists for believing the person violated this title. Notice to the alleged violator shall be deemed made on the date of service, the date the registered mail receipt is signed, or if the registered mail receipt is not signed, the date returned by the post office. A proceeding held for the purpose of considering probable cause shall be private unless the alleged violator files with the agency a written request that the proceeding be public. ref
- Art. 1798.199.55. Untitled (8)
- Art. 1798.199.60. Whenever the agency rejects the decision of an administrative law judge made pursuant to Section 11517 of the Government Code, the agency shall state the reasons in writing for rejecting the decision. ref
- Art. 1798.199.65. The agency may subpoena witnesses, compel their attendance and testimony, administer oaths and affirmations, take evidence and require by subpoena the production of any books, papers, records, or other items material to the performance of the agency’s duties or exercise of its powers, including, but not limited to, its power to audit a business’ compliance with this title. ref
- Art. 1798.199.70. No administrative action brought pursuant to this title alleging a violation of any of the provisions of this title shall be commenced more than five years after the date on which the violation occurred. (3)
- Art. 1798.199.75. Untitled (5)
- Art. 1798.199.80. Untitled (5)
- Art. 1798.199.85. Any decision of the agency with respect to a complaint or administrative fine shall be subject to judicial review in an action brought by an interested party to the complaint or administrative fine and shall be subject to an abuse of discretion standard. ref
- Art. 1798.199.90. Untitled (6)
- Art. 1798.199.95. Untitled (6)
- Art. 1798.199.100. The agency and any court, as applicable, shall consider the good faith cooperation of the business, service provider, contractor, or other person in determining the amount of any administrative fine or civil penalty for a violation of this title. A business shall not be required by the agency, a court, or otherwise to pay both an administrative fine and a civil penalty for the same violation. ref
Title I — California Consumer Privacy Act of 2018 (CCPA/CPRA)
Chapter I — California Consumer Privacy Act (Cal. Civ. Code 1798.100-1798.199.100)
Article 1798.199.40. The agency shall perform the following functions:
5 obligations
CCPA-1798.199.40-11
Requirement
Cooperate with other privacy authorities for consistent application
The agency must cooperate with other agencies with jurisdiction over privacy laws and with data processing authorities i
CCPA-1798.199.40-12
Registration
Establish voluntary certification mechanism for non-business entities
The agency must establish a mechanism pursuant to which persons doing business in California that do not meet the defini
CCPA-1798.199.40-13
Transparency
Maintain public list of voluntarily certified entities
The agency must make a list of entities that have voluntarily certified compliance with the CCPA available to the public
CCPA-1798.199.40-14
Requirement
Solicit, review, and approve grant applications
The agency must solicit, review, and approve applications for grants to the extent funds are available pursuant to parag
CCPA-1798.199.40-15
Requirement
Perform necessary acts and balance consumer privacy with business impact
The agency must perform all other acts necessary or appropriate in the exercise of its power, authority, and jurisdictio
Article 1798.199.45. Untitled
4 obligations
CCPA-1798.199.45-01
Monitoring
Agency Investigation Authority
The agency may investigate possible violations of this title relating to any business, service provider, contractor, or
CCPA-1798.199.45-02
Monitoring
Agency Decision on Investigation and Cure Period
The agency may decide not to investigate a complaint or decide to provide a business with a time period to cure the alle
CCPA-1798.199.45-03
Requirement
Written Notification to Complainant Requirement
The agency shall notify in writing the person who made the complaint of the action, if any, the agency has taken or plan
CCPA-1798.199.45-04
Prohibition
Information Exclusion from Written Notification
The written notification to complainants shall not include information that is subject to law enforcement exemptions and
Article 1798.199.55. Untitled
8 obligations
CCPA-1798.199.55-01
Requirement
Conduct hearing when probable cause of violation exists
The agency must hold a hearing to determine if violations have occurred when it determines there is probable cause for b
CCPA-1798.199.55-02
Requirement
Issue cease and desist order for violations
The agency may require violators to cease and desist violation of this title if violations are determined to have occurr
CCPA-1798.199.55-03
Requirement
Assess administrative fines for violations
The agency may impose administrative fines up to $2,500 per violation, or up to $7,500 for each intentional violation an
CCPA-1798.199.55-04
Requirement
Deposit 95% of fines into Consumer Privacy Subfund
The agency must deposit ninety-five percent of any administrative fine into the Consumer Privacy Subfund created within
CCPA-1798.199.55-05
Requirement
Deposit 5% of fines into Consumer Privacy Grant Subfund
The agency must deposit five percent of any administrative fine into the Consumer Privacy Grant Subfund created within t
CCPA-1798.199.55-06
Transparency
Publish declaration when no violation found
The agency must publish a declaration stating that no violation has occurred when it determines through the hearing proc
CCPA-1798.199.55-07
Prohibition
Comply with cease and desist orders
Violators must cease and desist violation of this title when ordered to do so by the agency following a determination of
CCPA-1798.199.55-08
Requirement
Pay assessed administrative fines
Violators must pay administrative fines when assessed by the agency, which may be up to $2,500 per violation or up to $7
Article 1798.199.70. No administrative action brought pursuant to this title alleging a violation of any of the provisions of this title shall be commenced more than five years after the date on which the violation occurred.
3 obligations
CCPA-1798.199.70-01
Requirement
Five-Year Statute of Limitations for Administrative Actions
Administrative enforcement agencies must commence any administrative action alleging a violation of CCPA provisions with
CCPA-1798.199.70-02
Prohibition
Prohibition on Fraudulent Concealment of Acts or Identity
Entities subject to CCPA must not engage in fraudulent concealment of their acts or identity, defined as knowingly conce
CCPA-1798.199.70-03
Requirement
Compliance with Court Orders for Document Production
Entities subject to administrative proceedings under CCPA must produce documents by the date ordered when a superior cou
Article 1798.199.75. Untitled
5 obligations
CCPA-1798.199.75-01
Requirement
Follow Proper Procedures When Filing Civil Action for Unpaid Administrative Fines
When bringing a civil action to collect unpaid administrative fines after exhaustion of judicial review, the agency must
CCPA-1798.199.75-02
Requirement
Prove Administrative Fines Were Imposed Following Proper Procedures
In civil proceedings to collect unpaid administrative fines, the agency must demonstrate that the administrative fines w
CCPA-1798.199.75-03
Requirement
Prove Proper Notice Was Given of Administrative Fines
In civil proceedings to collect unpaid administrative fines, the agency must demonstrate that the defendant(s) were noti
CCPA-1798.199.75-04
Requirement
Prove Demand for Payment Was Made and Not Satisfied
In civil proceedings to collect unpaid administrative fines, the agency must demonstrate that a demand for payment has b
CCPA-1798.199.75-05
Requirement
Commence Civil Action Within Four-Year Limitation Period
Any civil action brought to collect unpaid administrative fines must be commenced within four years after the date on wh