CCPA Compliance Checklist for California Businesses (2026)

Does CCPA apply to your business?

The law generally covers qualifying for-profit businesses that do business in California, collect California residents’ personal information, determine the purposes and means of processing it, and meet at least one of the following tests. Coverage can also extend to certain affiliated or jointly controlled businesses; exemptions may apply to particular information rather than an entire company. [Source: §1798.140(d), §1798.145]

[Source: §1798.140(d)(1)][Source: adjusted monetary threshold]

Visitor counts alone are not the information-volume test. If you are near a threshold, have affiliated businesses, or are unsure how ad-tech activity counts, seek qualified advice about your specific practices.

The checklist: 11 items to review

Record what you tested, when you tested it, and what needs follow-up.

1. Make the opt-out accessible and functional

If your business sells or shares personal information, review the “Do Not Sell or Share My Personal Information” link and request flow. The rules permit certain alternative links and, for businesses meeting the specified frictionless opt-out preference signal conditions, an exception to displaying the links. Do not assume a cookie banner qualifies. [Source: §1798.135][Source: §§7013, 7015, 7025–7026]

Click through yourself, submit a test request, and check whether covered sale or sharing actually stops—not just whether a confirmation appears.

2. Honor Global Privacy Control signals

For a business selling or sharing personal information, a qualifying opt-out preference signal, such as GPC, must be processed as an opt-out request for the browser or device and any consumer profiles associated with it, including an identified consumer where applicable. [Source: §7025]

Test whether relevant website and vendor behavior changes. A privacy notice, banner, or declared GPC support is not proof that tracking behavior responds correctly.

3. Review privacy policies and collection notices

Your privacy policy must disclose the required practices and rights and be updated at least once every 12 months. A Notice at Collection must be provided at or before collection and include the relevant categories, purposes, sale or sharing information, and retention periods or criteria. [Source: §1798.100(a), §1798.130(a)(5)][Source: §§7011–7012]

Review sooner when your practices or vendors change.

4. Match request methods and deadlines to the right

Requests to know, delete, and correct generally require at least two designated submission methods, including a toll-free telephone number and a website submission method if the business has a website. An exclusively online business with a direct relationship with the consumer from whom it collects information may provide only an email address for these requests. Choose methods that reflect how your business interacts with consumers. [Source: §1798.130(a)(1)][Source: §7020]

Opt-out requests follow separate rules: provide at least two methods. A business collecting online must accept an opt-out preference signal plus an interactive form accessible through the opt-out link, alternative link, or privacy policy when it processes signals frictionlessly. A toll-free number is not universally required for opt-outs, and opt-outs do not require identity verification. [Source: §7026]

Respond to requests to know, delete, or correct within 45 calendar days of receipt. A permitted extension may add another 45 calendar days when necessary, with notice and an explanation. By contrast, comply with a sale/sharing opt-out as soon as feasibly possible and no later than 15 business days after receipt. [Source: §7021, §7026]

5. Check vendor contracts for purpose limits

Review the required terms in agreements with service providers, contractors, and third parties receiving personal information, including specified purposes, limits, and oversight or remediation provisions. Pay attention to advertising, analytics, HR, and enrichment vendors. [Source: §1798.100(d)][Source: §§7051, 7053]

A contract checklist does not establish that a vendor’s actual practices match its agreement.

6. Review sensitive personal information

Identify sensitive personal information, such as precise geolocation, certain identifiers, account credentials, and information concerning health. Where uses or disclosures trigger the right to limit, provide the required method; uses within the permitted purposes and applicable exceptions may not trigger it. [Source: §1798.140(ae), §1798.121][Source: §7027]

7. Include employees and applicants

Do not limit your review to customer data. California residents’ employee and applicant information can also fall within the CCPA; the former employment-data exemption has expired. Review notices, requests, and recruiting or HR vendors, subject to applicable exceptions. [Source: §1798.140(i), §1798.145(m)]

8. Prepare for covered ADMT use

Businesses using ADMT as defined by the regulations to make significant decisions must comply with applicable ADMT requirements beginning January 1, 2027. These include pre-use notice, access, and opt-out requirements, subject to specified exceptions. Not every AI tool or recruiting workflow falls within this scope. [Source: §§7200–7222]

For staffing agencies and employers using AI resume screening, inventory the tools, assess how they affect decisions, and plan notices and request handling for covered uses.

9. Determine whether risk assessments are required

Assess whether your processing presents significant risk under the regulations, including covered sale or sharing, sensitive information processing, and specified ADMT uses. The rules distinguish new processing from processing already underway, so confirm the timing that applies before treating a monthly file as sufficient. [Source: §§7150–7157]

If an assessment is required, document the processing, benefits, risks, safeguards, and resulting decision—not just that a scan ran.

10. Check whether you are a data broker

A business knowingly collecting and selling consumers’ personal information to third parties without a direct relationship may meet California’s data-broker definition, subject to statutory exclusions. If required, register and review applicable Delete Act and DROP duties. Failure to register can carry an administrative fine of $200 for each day the broker fails to register. [Source: §§1798.99.80–1798.99.82][Source: DROP regulations]

11. Keep a dated evidence file

We recommend saving screenshots, test results, notices, vendor reviews, decisions, and follow-up actions in a monthly evidence file. This cadence is an operational recommendation, not a blanket CCPA requirement. Required consumer-request records have their own retention rules. [Source: §7101]

A 10-minute first check of your opt-out

This is an initial usability check, not proof of full compliance. Confirming vendor behavior may require additional browser and network testing.

1. Open your website in a private or incognito window.
2. Find the sale/sharing opt-out or permitted privacy-preferences link.
3. Submit a test opt-out. Note unnecessary information requests or obstacles.
4. Record the outcome, time, and a screenshot of any confirmation.
5. Enable GPC in a browser that supports it.
6. Reload and inspect whether the signal is honored and the relevant vendor behavior changes. A banner alone is not proof.

[Source: §§7025–7026]

Failure modes to look for

• A hard-to-find link. Check entry points and pages where the link should appear.
• Confirmation without action. The form confirms receipt while covered sharing continues.
• GPC detected but ignored. The page displays a signal without applying the opt-out.
• Outdated vendor terms. New scripts or vendors no longer match the contract or notice.

These are review scenarios, not measured findings about the frequency of problems. [Source: §§7013, 7025–7026, 7051–7053]

CCPA penalties: what to know

Adjusted civil and administrative penalty ceilings are $2,663 per violation and $7,988 per intentional violation or a violation involving personal information of consumers known to be under age 16. The Attorney General and CPPA have enforcement roles. [Source: §1798.155][Source: adjusted penalty amounts]

There is no blanket 30-day cure period for agency enforcement. The separate notice-and-cure provision for certain private actions has a different scope, and implementing reasonable security after a breach does not itself cure that breach. [Source: §1798.150(b), §1798.155]

How often should you re-check?

We recommend monthly operational checks and another review after significant website or vendor changes. Keep the results in your evidence file. This recommendation does not replace the legal deadlines or the privacy policy’s required update cadence discussed above.

Primary sources

• CCPA statute text (Civ. Code §1798.100 et seq.), effective Jan 1, 2026 — cppa.ca.gov
• CPPA — Updated Monetary Thresholds in CCPA (Civ. Code §1798.199.95(d))
• CPPA — CCPA Updates, Cybersecurity Audits, Risk Assessments, ADMT, and Insurance Regulations
• CPPA — California Consumer Privacy Act Regulations (Cal. Code Regs., tit. 11, §7000 et seq.)
• Delete Act statute text (Civ. Code §1798.99.80 et seq.) — cppa.ca.gov
• CPPA — Delete Request and Opt-out Platform (DROP) regulations
• CPPA — Data Broker Registry

Everproof provides compliance software and operations support. It is not a law firm and does not provide legal advice. Using Everproof does not guarantee compliance or prevent fines.