CCPA-CPRA
California Consumer Privacy Act of 2018 (as amended by CPRA)
- I. California Consumer Privacy Act of 2018 (CCPA/CPRA)
- Ch. I — California Consumer Privacy Act (Cal. Civ. Code 1798.100-1798.199.100)
- Art. 1798.100. General Duties of Businesses that Collect Personal Information (15)
- Art. 1798.105. Consumers’ Right to Delete Personal Information (9)
- Art. 1798.106. Consumers’ Right to Correct Inaccurate Personal Information (3)
- Art. 1798.110. Consumers’ Right to Know What Personal Information is Being Collected. Right to Access Personal Information (10)
- Art. 1798.115. Consumers’ Right to Know What Personal Information is Sold or Shared and to Whom (6)
- Art. 1798.120. Consumers’ Right to Opt Out of Sale or Sharing of Personal Information (6)
- Art. 1798.121. Consumers’ Right to Limit Use and Disclosure of Sensitive Personal Information (4)
- Art. 1798.125. Consumers’ Right of No Retaliation Following Opt Out or Exercise of Other Rights (11)
- Art. 1798.130. Notice, Disclosure, Correction, and Deletion Requirements (28)
- Art. 1798.135. Methods of Limiting Sale, Sharing, and Use of Personal Information and Use of Sensitive Personal Information (20)
- Art. 1798.136. Untitled (3)
- Art. 1798.140. Definitions (21)
- Art. 1798.145. Exemptions (12)
- Art. 1798.146. Untitled (6)
- Art. 1798.148. Untitled (6)
- Art. 1798.150. Personal Information Security Breaches (4)
- Art. 1798.155. Administrative Enforcement (3)
- Art. 1798.160. Consumer Privacy Fund (14)
- Art. 1798.175. Conflicting Provisions (3)
- Art. 1798.180. Preemption (1)
- Art. 1798.185. Regulations (31)
- Art. 1798.190. Anti-Avoidance (2)
- Art. 1798.192. Waiver (5)
- Art. 1798.194. This title shall be liberally construed to effectuate its purposes. ref
- Art. 1798.196. This title is intended to supplement federal and state law, if permissible, but shall not apply if such application is preempted by, or in conflict with, federal law or the United States or California Constitution. ref
- Art. 1798.198. Untitled (2)
- Art. 1798.199. Notwithstanding Section 1798.198, Section 1798.180 shall be operative on the effective date of the act adding this section. ref
- Art. 1798.199.10. Untitled (8)
- Art. 1798.199.15. Members of the agency board shall: (7)
- Art. 1798.199.20. Members of the agency board, including the chairperson, shall serve at the pleasure of their appointing authority but shall serve for no longer than eight consecutive years. ref
- Art. 1798.199.25. For each day on which they engage in official duties, members of the agency board shall be compensated at the rate of one hundred dollars ($100), adjusted pursuant to subdivision (d) of Section 1798.199.95, and shall be reimbursed for expenses incurred in performance of their official duties. ref
- Art. 1798.199.30. The agency board shall appoint an executive director who shall act in accordance with agency policies and regulations and with applicable law. The agency shall appoint and discharge officers, counsel, and employees, consistent with applicable civil service laws, and shall fix the compensation of employees and prescribe their duties. The agency may contract for services that cannot be provided by its employees. ref
- Art. 1798.199.35. The agency board may delegate authority to the chairperson or the executive director to act in the name of the agency between meetings of the agency, except with respect to resolution of enforcement actions and rulemaking authority. ref
- Art. 1798.199.40. The agency shall perform the following functions: (15)
- Art. 1798.199.45. Untitled (4)
- Art. 1798.199.50. No finding of probable cause to believe this title has been violated shall be made by the agency unless, at least 30 days prior to the agency’s consideration of the alleged violation, the business, service provider, contractor, or person alleged to have violated this title is notified of the violation by service of process or registered mail with return receipt requested, provided with a summary of the evidence, and informed of their right to be present in person and represented by counsel at any proceeding of the agency held for the purpose of considering whether probable cause exists for believing the person violated this title. Notice to the alleged violator shall be deemed made on the date of service, the date the registered mail receipt is signed, or if the registered mail receipt is not signed, the date returned by the post office. A proceeding held for the purpose of considering probable cause shall be private unless the alleged violator files with the agency a written request that the proceeding be public. ref
- Art. 1798.199.55. Untitled (8)
- Art. 1798.199.60. Whenever the agency rejects the decision of an administrative law judge made pursuant to Section 11517 of the Government Code, the agency shall state the reasons in writing for rejecting the decision. ref
- Art. 1798.199.65. The agency may subpoena witnesses, compel their attendance and testimony, administer oaths and affirmations, take evidence and require by subpoena the production of any books, papers, records, or other items material to the performance of the agency’s duties or exercise of its powers, including, but not limited to, its power to audit a business’ compliance with this title. ref
- Art. 1798.199.70. No administrative action brought pursuant to this title alleging a violation of any of the provisions of this title shall be commenced more than five years after the date on which the violation occurred. (3)
- Art. 1798.199.75. Untitled (5)
- Art. 1798.199.80. Untitled (5)
- Art. 1798.199.85. Any decision of the agency with respect to a complaint or administrative fine shall be subject to judicial review in an action brought by an interested party to the complaint or administrative fine and shall be subject to an abuse of discretion standard. ref
- Art. 1798.199.90. Untitled (6)
- Art. 1798.199.95. Untitled (6)
- Art. 1798.199.100. The agency and any court, as applicable, shall consider the good faith cooperation of the business, service provider, contractor, or other person in determining the amount of any administrative fine or civil penalty for a violation of this title. A business shall not be required by the agency, a court, or otherwise to pay both an administrative fine and a civil penalty for the same violation. ref
Title I — California Consumer Privacy Act of 2018 (CCPA/CPRA)
Chapter I — California Consumer Privacy Act (Cal. Civ. Code 1798.100-1798.199.100)
Article 1798.121. Consumers’ Right to Limit Use and Disclosure of Sensitive Personal Information
3 obligations
CCPA-1798.121-02
Prohibition
Prohibition on Using Sensitive Personal Information After Consumer Direction to Limit
After receiving direction from a consumer to limit use or disclosure of sensitive personal information, businesses are p
CCPA-1798.121-03
Prohibition
Service Provider/Contractor Limitation on Sensitive Personal Information Use
Service providers or contractors that assist businesses and have received instructions from the business, with actual kn
CCPA-1798.121-04
Requirement
Limited Scope of Service Provider/Contractor Limitation Requirements
Service providers or contractors are only required to limit their use of sensitive personal information when: (1) the in
Article 1798.125. Consumers’ Right of No Retaliation Following Opt Out or Exercise of Other Rights
11 obligations
CCPA-1798.125-01
Prohibition
Prohibition on Denying Goods or Services for Rights Exercise
A business must not deny goods or services to a consumer because the consumer exercised any of their rights under the CC
CCPA-1798.125-02
Prohibition
Prohibition on Differential Pricing for Rights Exercise
A business must not charge different prices or rates for goods or services, including through discounts, benefits, or pe
CCPA-1798.125-03
Prohibition
Prohibition on Differential Service Quality for Rights Exercise
A business must not provide a different level or quality of goods or services to a consumer because the consumer exercis
CCPA-1798.125-04
Prohibition
Prohibition on Suggesting Differential Treatment for Rights Exercise
A business must not suggest that a consumer will receive different pricing, rates, or service quality because the consum
CCPA-1798.125-05
Prohibition
Prohibition on Employee/Contractor Retaliation for Rights Exercise
A business must not retaliate against employees, employment applicants, or independent contractors for exercising their
CCPA-1798.125-06
Requirement
Requirement for Data Value-Based Pricing Justification
When charging different prices or providing different service levels based on consumer data value, a business must ensur
CCPA-1798.125-07
Requirement
Requirement for Financial Incentive Data Value Justification
A business offering different prices or service levels in financial incentive programs must ensure such differences are
CCPA-1798.125-08
Transparency
Requirement for Financial Incentive Consumer Notification
A business that offers financial incentives must notify consumers of such incentives pursuant to Section 1798.130.
CCPA-1798.125-09
Requirement
Requirement for Prior Opt-In Consent for Financial Incentives
A business may only enter a consumer into a financial incentive program after obtaining the consumer's prior opt-in cons
CCPA-1798.125-10
Requirement
Requirement for 12-Month Wait After Consent Refusal
If a consumer refuses to provide opt-in consent for a financial incentive program, the business must wait at least 12 mo
CCPA-1798.125-11
Prohibition
Prohibition on Unjust Financial Incentive Practices
A business must not use financial incentive practices that are unjust, unreasonable, coercive, or usurious in nature.
Article 1798.130. Notice, Disclosure, Correction, and Deletion Requirements
11 obligations
CCPA-1798.130-01
Requirement
Provide Multiple Consumer Request Submission Methods
Make available to consumers two or more designated methods for submitting requests for information disclosure, deletion,
CCPA-1798.130-02
Requirement
Provide Website-Based Request Submission Method
If the business maintains an internet website, make the website available to consumers to submit requests for informatio
CCPA-1798.130-03
Requirement
Respond to Consumer Requests Within 45 Days
Disclose and deliver required information, correct inaccurate personal information, or delete consumer personal informat
CCPA-1798.130-04
Requirement
Promptly Determine Request Verifiability
Promptly take steps to determine whether a consumer request is a verifiable consumer request, without extending the 45-d
CCPA-1798.130-05
Requirement
Deliver Information in Specified Format and Method
Deliver disclosed information in writing through consumer's account if maintained, or by mail/electronically at consumer
CCPA-1798.130-06
Requirement
Implement Reasonable Authentication Without Requiring New Accounts
Require authentication that is reasonable given the nature of personal information requested, but cannot require consume
CCPA-1798.130-07
Requirement
Provide 12-Month Historical Data Coverage
Disclosure of required information must cover the 12-month period preceding receipt of the verifiable consumer request.
CCPA-1798.130-08
Requirement
Disclose All Personal Information Collected About Consumer
Upon receiving verifiable consumer request under Sections 1798.110 or 1798.115, disclose any personal information collec
CCPA-1798.130-09
Requirement
Service Provider Assistance with Business Requests
Service providers and contractors must assist businesses with verifiable consumer request responses, including providing
CCPA-1798.130-10
Requirement
Service Provider Technical and Organizational Compliance Assistance
Service providers and contractors collecting personal information under written contract must assist businesses through
CCPA-1798.130-11
Requirement
Identify and Associate Consumer Information for Section 1798.110 Requests
For Section 1798.110(b) purposes, identify the consumer and associate information provided in verifiable consumer reques