Privacy Laws
California Consumer Privacy Act as amended by the CPRA
The CCPA and the California Privacy Rights Act, and the rights they created for California consumers.
Structure
The statute is in the California Civil Code, Title 1.81.5. That location is unusual and is the reason most citations look unfamiliar: the CCPA is not in the Government Code or the Privacy Code, and searches for “California privacy law” frequently miss it.
The CPRA did not create a new code section. It amended the existing one, which is why the statutory text is read as a single body with the amendments folded in.
The rights
| Right | Substance |
|---|---|
| Know | Disclose categories of personal information collected, sources, purposes, and categories of recipients |
| Delete | Deletion of collected information, subject to exceptions |
| Correct | Rectification of inaccurate personal information |
| Opt out of sale or sharing | Business may not sell or share personal information without opt-in consent |
| Limit | Limit use and disclosure of sensitive personal information |
| Non-discrimination | Denial of goods or services for exercising a right is unlawful |
| Portability | In some circumstances, transfer of information to a third party |
Opt-in and opt-out
The distinction that matters most in practice is that selling or sharing personal information requires opt-in consent, while other uses generally require an opt-out link. The CPRA added “sharing” for cross-context behavioural advertising to the original sale prohibition, which is what brought a large number of advertising businesses into scope.
Limitations worth knowing before relying on it
- The thresholds exclude many small businesses, though the definition of “business” is broad and includes for-profit entities that meet the revenue threshold and do business in California.
- Some rights are limited by exceptions, including security, fraud prevention, and legal compliance purposes.
- The right to know is subject to exceptions and to security-trade-secret limits.
- Enforcement was historically carried out by the Attorney General; the CPRA created a dedicated agency with its own authority.
Other US state laws
Several states have since enacted comparable statutes. Those are tracked separately in US state privacy laws.
Sources
- California Civil Code, Title 1.81.5 — the statutory text as amended. This is the primary record.
- AB 3746 (2018) — the original bill text.
- California Privacy Protection Agency — the regulator, and the place to check current enforcement activity rather than assuming it.
Claim labels
FACT
The California Consumer Privacy Act was enacted as California Civil Code Title 1.81.5 by AB 3746, signed on 28 June 2018.
FACT
Proposition 24, the California Privacy Rights Act, was approved by voters on 3 November 2020 and took effect on 1 January 2023, with certain provisions applying earlier.
FACT
The CPRA established the California Privacy Protection Agency and gave it enforcement authority.
FACT
The CCPA as amended gives consumers the right to know, the right to delete, the right to correct, the right to opt out of sale or sharing, the right to limit use of sensitive personal information, and the right to non-discrimination for exercising these rights.
FACT
The amendment introduced the right to correct inaccurate personal information, which the original CCPA did not contain.
FACT
The statute applies to a "business" as defined in the statute, which includes for-profit businesses meeting a revenue threshold doing business in California, and to entities that determine the purposes and means of processing consumers' personal information.
SOURCE CLAIM
The Cal-Ore and other privacy advocacy organisations have characterised the CPRA as raising the standard beyond the original CCPA. That is advocacy, not a finding of the legislature or the courts.
Sources
Last link check: 2026-09-27. A link check confirms reachability, not that every claim has been independently reviewed.