California reference dataset
California CCPA request deadlines and applicability
Covered requests generally require acknowledgment within 10 business days and a response within 45 calendar days.
Sale or sharing opt-outs and sensitive-information limitation requests require action as soon as feasible, within 15 business days at the latest.
Verified October 18, 2026. Dataset version 2026-10-18.1. Published by Business Compliance Tools.
Scope and method
California CCPA ordinary business coverage and deletion, correction, knowledge, sale/sharing opt-out, and sensitive-information limitation request timing.
This is a California snapshot. It does not cover every US state or decide whether a particular organization or request is covered.
We checked the CPPA's January 2026 statute and regulations, then applied its current monetary adjustment to the statutory revenue comparison.
The revenue threshold is greater than $26,625,000. The statute's printed $25,000,000 amount requires the inflation adjustment.
Business-day values preserve the regulation's unit. This reference does not calculate dates or apply a holiday calendar.
Open the existing rights-request clock. Its California business-day calculations use weekdays only, as the calculator explains.
Outside this dataset's scope. Other states and countries; Automatic applicability decisions; Exhaustive exemption analysis; ADMT requests; Cybersecurity audits and risk assessments; Delete Act DROP requests; Holiday calendars and calculated due dates.
Applicability reference
For the ordinary business route, all base conditions apply, together with at least one of the three alternative thresholds.
| Rule | Requirement | Trigger and conditions | Official provision |
|---|---|---|---|
| Ordinary business routeCA-CCPA-APPL-BASE | For-profit entity, California business activity, collection of consumer personal information, and control of processing purposes and means. | Assess business coverage. All base conditions plus at least one threshold below. Collection on the entity's behalf also counts. | Civil Code 1798.140(d)(1)PDF page 20 |
| Gross revenue thresholdCA-CCPA-APPL-REVENUE | Annual gross revenue exceeds the inflation-adjusted threshold.greater than 26,625,000 USD | As of January 1, using the preceding calendar year. One alternative threshold within the ordinary business route. The statutory comparator is strictly greater than. | Civil Code 1798.140(d)(1)(A)PDF page 20 Civil Code 1798.199.95(d)PDF page 66 CPPA adjustment Revenue threshold, effective January 1, 2025 |
| Personal information volume thresholdCA-CCPA-APPL-VOLUME | Annually buys, sells, or shares personal information of at least 100,000 consumers or households, alone or in combination.at least 100,000 consumers or households | Annual activity. One alternative threshold within the ordinary business route. | Civil Code 1798.140(d)(1)(B)PDF page 20 |
| Sale or sharing revenue thresholdCA-CCPA-APPL-SALE-SHARE | At least half of annual revenue comes from selling or sharing consumers' personal information.at least 50 percent | Annual revenue. One alternative threshold within the ordinary business route. | Civil Code 1798.140(d)(1)(C)PDF page 20 |
| Other business routesCA-CCPA-APPL-OTHER | Certain related entities, joint ventures or partnerships, and voluntary certification can establish coverage separately. | Ordinary threshold route is inconclusive. Review the full conditions in paragraphs (2), (3), and (4). This dataset does not decide those routes. | Civil Code 1798.140(d)(2)PDF page 20 Civil Code 1798.140(d)(3)-(4)PDF page 21 |
| ConsumerCA-CCPA-APPL-CONSUMER | A natural person who is a California resident. | Assess the person making the request. Residence uses the definition incorporated by section 1798.140(i). | Civil Code 1798.140(i)PDF page 22 |
Request deadline reference
| Rule | Requirement | Trigger and conditions | Official provision |
|---|---|---|---|
| Acknowledge deletion, correction, or knowledge requestCA-CCPA-REQ-ACK | Confirm receipt and explain processing within 10 business days.no later than 10 business days | Receipt of the request. Explain verification and expected response, except where already granted or denied. | 11 CCR 7021(a)PDF page 35 |
| Respond to deletion, correction, or knowledge requestCA-CCPA-REQ-RESPONSE | Respond within 45 calendar days. Verification does not pause the clock.no later than 45 calendar days | Receipt, regardless of verification time. A request that cannot be verified within the period may be denied. | 11 CCR 7021(b)PDF page 35 |
| Extend deletion, correction, or knowledge responseCA-CCPA-REQ-EXTENSION | One extension of up to 45 additional calendar days, with a 90-day total ceiling.additional maximum 45 calendar days; 90 calendar days total | Receipt of the original request. Reasonable necessity. Give notice and the reason within the first 45 days. | 11 CCR 7021(b)PDF page 35 Civil Code 1798.130(a)(2)(A)PDF page 11 |
| Stop sale or sharingCA-CCPA-REQ-OPT-OUT | Act as soon as feasible, within 15 business days at the latest.no later than 15 business days | Receipt of the opt-out request. No verifiable consumer request is required. Fifteen business days is a ceiling, not a waiting period. | 11 CCR 7026(d), (f)(1)PDF page 51 |
| Limit sensitive personal information use or disclosureCA-CCPA-REQ-LIMIT | Act as soon as feasible, within 15 business days at the latest.no later than 15 business days | Receipt of the limitation request. No verifiable consumer request is required. Apply the purpose-based limits and exceptions in section 7027(a), (m). | 11 CCR 7027(a)PDF page 53 11 CCR 7027(e), (g)(1)PDF page 54 11 CCR 7027(m)PDF page 55 |
Known exclusions and review limits
This list is not exhaustive. Review the full provisions before applying a deadline or treating information as exempt.
- Request-specific exceptions. Deletion exceptions, legal obligations, and other statutory exemptions require separate review. 1798.105(d); 1798.145; 1798.146.
- Sector and information exemptions. Health information, regulated consumer reporting, and financial information have conditional exemptions. This is not a blanket exemption for every organization in those sectors. 1798.145(c)-(e); 1798.146.
- Sensitive information limits. Certain permitted purposes and processing without the purpose of inferring characteristics fall outside requests to limit. 7027(a), (m).
Official sources
- California Consumer Privacy Act, effective January 1, 2026. California Privacy Protection Agency. California Civil Code, Title 1.81.5. Effective 2026-01-01. Verified 2026-10-18.
- CCPA regulations, effective January 1, 2026. California Privacy Protection Agency. California Code of Regulations, Title 11, Division 6, Chapter 1. Effective 2026-01-01. Verified 2026-10-18.
- Updated monetary thresholds in the CCPA. California Privacy Protection Agency. Adjustment under Civil Code section 1798.199.95(d). Effective 2025-01-01. Verified 2026-10-18.
The CPPA's current laws and regulations register identifies these current texts. Check it for later amendments.
Reuse the data
JSON includes scope, exclusions, sources, stable rule identifiers, typed values, exact provisions, and the changelog. CSV includes the same rule rows and source metadata.
CSV columns and rule identifiers stay stable within schema version 1. A changed requirement receives a dated changelog entry.
Empty numeric cells mean the rule has no numeric value. They do not mean zero or that the rule does not apply.
Changelog
- . Version 2026-10-18.1. Initial California-only snapshot. Checked current CPPA statute, regulations, and the inflation-adjusted revenue threshold.
Browse privacy tools. Have a person review your website privacy notice and tracking.