California

Comprehensive law in force

The most developed privacy regime in the United States, and the only one with a dedicated regulator. The CCPA as amended by the CPRA gives Californians access, correction, deletion, portability, opt-out and sensitive-data rights, and since January 2026 adds cybersecurity audits, risk assessments and rules on automated decision-making.

Regulators

California is the only US state with a dedicated privacy regulator. Rulemaking authority transferred from the Attorney General to the Agency in 2022, but both still enforce — so a business can hear from either.

Effective dates since the CCPA

todayCCPA / CPRAJanuary 1, 2020California Privacy Rights Act (Proposition 24)January 1, 2023First CPPA regulations effectiveMarch 29, 2023Delete ActJanuary 1, 2024AB 254 and AB 352 — reproductive and gender-affirming careJanuary 1, 2024AB 1008 — personal information in AI systemsJanuary 1, 2025SB 1223 — neural dataJanuary 1, 2025AB 1824 — opt-outs survive a mergerJanuary 1, 2025CCPA Updates, Cyber, Risk and ADMT RegulationsJanuary 1, 2026DROP opens to consumersJanuary 1, 2026

The California stack — 7 laws

CCPA / CPRA

Cal. Civ. Code §§ 1798.100–1798.199.100

California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020

In force since January 1, 2020

Read the full record11 rights · 2 primary sources

Delete Act

Cal. Civ. Code §§ 1798.99.80–1798.99.89

California Delete Act (SB 362)

In force since January 1, 2024

Read the full record2 rights · 2 primary sources

Breach notification

Cal. Civ. Code §§ 1798.29, 1798.82

California data breach notification statute

In force since July 1, 2003

Read the full record1 right · 2 primary sources

CMIA

Cal. Civ. Code §§ 56–56.37

Confidentiality of Medical Information Act

In force since January 1, 1982

Read the full record2 rights · 1 primary source

CalOPPA

Cal. Bus. & Prof. Code §§ 22575–22579

California Online Privacy Protection Act

In force since July 1, 2004

Read the full record1 right · 1 primary source

Shine the Light

Cal. Civ. Code § 1798.83

California Shine the Light law

In force since January 1, 2005

Read the full record2 rights · 1 primary source

CIPA

Cal. Penal Code §§ 630–638.55

California Invasion of Privacy Act

In force since January 1, 1967

Read the full record1 right · 1 primary source

California sources