{
  "schemaVersion": 1,
  "id": "california-ccpa-request-rules",
  "version": "2026-10-18.1",
  "jurisdiction": "US-CA",
  "title": "California CCPA request deadlines and applicability",
  "publisher": "Business Compliance Tools",
  "verifiedDate": "2026-10-18",
  "scope": "California CCPA ordinary business coverage and deletion, correction, knowledge, sale/sharing opt-out, and sensitive-information limitation request timing.",
  "outsideScope": [
    "Other states and countries",
    "Automatic applicability decisions",
    "Exhaustive exemption analysis",
    "ADMT requests",
    "Cybersecurity audits and risk assessments",
    "Delete Act DROP requests",
    "Holiday calendars and calculated due dates"
  ],
  "sources": [
    {
      "id": "ca-ccpa-statute-2026",
      "title": "California Consumer Privacy Act, effective January 1, 2026",
      "sourcePublisher": "California Privacy Protection Agency",
      "instrument": "California Civil Code, Title 1.81.5",
      "url": "https://cppa.ca.gov/pdf/20260101_ccpa_statute.pdf",
      "effectiveDate": "2026-01-01",
      "verifiedDate": "2026-10-18"
    },
    {
      "id": "ca-ccpa-regulations-2026",
      "title": "CCPA regulations, effective January 1, 2026",
      "sourcePublisher": "California Privacy Protection Agency",
      "instrument": "California Code of Regulations, Title 11, Division 6, Chapter 1",
      "url": "https://cppa.ca.gov/regulations/pdf/ccpa_statute_eff_20260101.pdf",
      "effectiveDate": "2026-01-01",
      "verifiedDate": "2026-10-18"
    },
    {
      "id": "ca-ccpa-cpi-2025",
      "title": "Updated monetary thresholds in the CCPA",
      "sourcePublisher": "California Privacy Protection Agency",
      "instrument": "Adjustment under Civil Code section 1798.199.95(d)",
      "url": "https://cppa.ca.gov/regulations/cpi_adjustment.html",
      "effectiveDate": "2025-01-01",
      "verifiedDate": "2026-10-18"
    }
  ],
  "rules": [
    {
      "id": "CA-CCPA-APPL-BASE",
      "category": "applicability",
      "subject": "Ordinary business route",
      "rule": "For-profit entity, California business activity, collection of consumer personal information, and control of processing purposes and means.",
      "value": null,
      "unit": null,
      "comparison": null,
      "maximumTotalDays": null,
      "trigger": "Assess business coverage.",
      "conditions": "All base conditions plus at least one threshold below. Collection on the entity's behalf also counts.",
      "provisions": [
        {
          "sourceId": "ca-ccpa-statute-2026",
          "section": "1798.140(d)(1)",
          "pdfPage": 20
        }
      ]
    },
    {
      "id": "CA-CCPA-APPL-REVENUE",
      "category": "applicability",
      "subject": "Gross revenue threshold",
      "rule": "Annual gross revenue exceeds the inflation-adjusted threshold.",
      "value": 26625000,
      "unit": "USD",
      "comparison": "greater_than",
      "maximumTotalDays": null,
      "trigger": "As of January 1, using the preceding calendar year.",
      "conditions": "One alternative threshold within the ordinary business route. The statutory comparator is strictly greater than.",
      "provisions": [
        {
          "sourceId": "ca-ccpa-statute-2026",
          "section": "1798.140(d)(1)(A)",
          "pdfPage": 20
        },
        {
          "sourceId": "ca-ccpa-statute-2026",
          "section": "1798.199.95(d)",
          "pdfPage": 66
        },
        {
          "sourceId": "ca-ccpa-cpi-2025",
          "section": "Revenue threshold, effective January 1, 2025",
          "pdfPage": null
        }
      ]
    },
    {
      "id": "CA-CCPA-APPL-VOLUME",
      "category": "applicability",
      "subject": "Personal information volume threshold",
      "rule": "Annually buys, sells, or shares personal information of at least 100,000 consumers or households, alone or in combination.",
      "value": 100000,
      "unit": "consumers_or_households",
      "comparison": "at_least",
      "maximumTotalDays": null,
      "trigger": "Annual activity.",
      "conditions": "One alternative threshold within the ordinary business route.",
      "provisions": [
        {
          "sourceId": "ca-ccpa-statute-2026",
          "section": "1798.140(d)(1)(B)",
          "pdfPage": 20
        }
      ]
    },
    {
      "id": "CA-CCPA-APPL-SALE-SHARE",
      "category": "applicability",
      "subject": "Sale or sharing revenue threshold",
      "rule": "At least half of annual revenue comes from selling or sharing consumers' personal information.",
      "value": 50,
      "unit": "percent",
      "comparison": "at_least",
      "maximumTotalDays": null,
      "trigger": "Annual revenue.",
      "conditions": "One alternative threshold within the ordinary business route.",
      "provisions": [
        {
          "sourceId": "ca-ccpa-statute-2026",
          "section": "1798.140(d)(1)(C)",
          "pdfPage": 20
        }
      ]
    },
    {
      "id": "CA-CCPA-APPL-OTHER",
      "category": "applicability",
      "subject": "Other business routes",
      "rule": "Certain related entities, joint ventures or partnerships, and voluntary certification can establish coverage separately.",
      "value": null,
      "unit": null,
      "comparison": null,
      "maximumTotalDays": null,
      "trigger": "Ordinary threshold route is inconclusive.",
      "conditions": "Review the full conditions in paragraphs (2), (3), and (4). This dataset does not decide those routes.",
      "provisions": [
        {
          "sourceId": "ca-ccpa-statute-2026",
          "section": "1798.140(d)(2)",
          "pdfPage": 20
        },
        {
          "sourceId": "ca-ccpa-statute-2026",
          "section": "1798.140(d)(3)-(4)",
          "pdfPage": 21
        }
      ]
    },
    {
      "id": "CA-CCPA-APPL-CONSUMER",
      "category": "applicability",
      "subject": "Consumer",
      "rule": "A natural person who is a California resident.",
      "value": null,
      "unit": null,
      "comparison": null,
      "maximumTotalDays": null,
      "trigger": "Assess the person making the request.",
      "conditions": "Residence uses the definition incorporated by section 1798.140(i).",
      "provisions": [
        {
          "sourceId": "ca-ccpa-statute-2026",
          "section": "1798.140(i)",
          "pdfPage": 22
        }
      ]
    },
    {
      "id": "CA-CCPA-REQ-ACK",
      "category": "deadline",
      "subject": "Acknowledge deletion, correction, or knowledge request",
      "rule": "Confirm receipt and explain processing within 10 business days.",
      "value": 10,
      "unit": "business_days",
      "comparison": "no_later_than",
      "maximumTotalDays": null,
      "trigger": "Receipt of the request.",
      "conditions": "Explain verification and expected response, except where already granted or denied.",
      "provisions": [
        {
          "sourceId": "ca-ccpa-regulations-2026",
          "section": "7021(a)",
          "pdfPage": 35
        }
      ]
    },
    {
      "id": "CA-CCPA-REQ-RESPONSE",
      "category": "deadline",
      "subject": "Respond to deletion, correction, or knowledge request",
      "rule": "Respond within 45 calendar days. Verification does not pause the clock.",
      "value": 45,
      "unit": "calendar_days",
      "comparison": "no_later_than",
      "maximumTotalDays": null,
      "trigger": "Receipt, regardless of verification time.",
      "conditions": "A request that cannot be verified within the period may be denied.",
      "provisions": [
        {
          "sourceId": "ca-ccpa-regulations-2026",
          "section": "7021(b)",
          "pdfPage": 35
        }
      ]
    },
    {
      "id": "CA-CCPA-REQ-EXTENSION",
      "category": "deadline",
      "subject": "Extend deletion, correction, or knowledge response",
      "rule": "One extension of up to 45 additional calendar days, with a 90-day total ceiling.",
      "value": 45,
      "unit": "calendar_days",
      "comparison": "additional_maximum",
      "maximumTotalDays": 90,
      "trigger": "Receipt of the original request.",
      "conditions": "Reasonable necessity. Give notice and the reason within the first 45 days.",
      "provisions": [
        {
          "sourceId": "ca-ccpa-regulations-2026",
          "section": "7021(b)",
          "pdfPage": 35
        },
        {
          "sourceId": "ca-ccpa-statute-2026",
          "section": "1798.130(a)(2)(A)",
          "pdfPage": 11
        }
      ]
    },
    {
      "id": "CA-CCPA-REQ-OPT-OUT",
      "category": "deadline",
      "subject": "Stop sale or sharing",
      "rule": "Act as soon as feasible, within 15 business days at the latest.",
      "value": 15,
      "unit": "business_days",
      "comparison": "no_later_than",
      "maximumTotalDays": null,
      "trigger": "Receipt of the opt-out request.",
      "conditions": "No verifiable consumer request is required. Fifteen business days is a ceiling, not a waiting period.",
      "provisions": [
        {
          "sourceId": "ca-ccpa-regulations-2026",
          "section": "7026(d), (f)(1)",
          "pdfPage": 51
        }
      ]
    },
    {
      "id": "CA-CCPA-REQ-LIMIT",
      "category": "deadline",
      "subject": "Limit sensitive personal information use or disclosure",
      "rule": "Act as soon as feasible, within 15 business days at the latest.",
      "value": 15,
      "unit": "business_days",
      "comparison": "no_later_than",
      "maximumTotalDays": null,
      "trigger": "Receipt of the limitation request.",
      "conditions": "No verifiable consumer request is required. Apply the purpose-based limits and exceptions in section 7027(a), (m).",
      "provisions": [
        {
          "sourceId": "ca-ccpa-regulations-2026",
          "section": "7027(a)",
          "pdfPage": 53
        },
        {
          "sourceId": "ca-ccpa-regulations-2026",
          "section": "7027(e), (g)(1)",
          "pdfPage": 54
        },
        {
          "sourceId": "ca-ccpa-regulations-2026",
          "section": "7027(m)",
          "pdfPage": 55
        }
      ]
    }
  ],
  "knownExclusions": [
    {
      "subject": "Request-specific exceptions",
      "detail": "Deletion exceptions, legal obligations, and other statutory exemptions require separate review.",
      "sourceId": "ca-ccpa-statute-2026",
      "section": "1798.105(d); 1798.145; 1798.146"
    },
    {
      "subject": "Sector and information exemptions",
      "detail": "Health information, regulated consumer reporting, and financial information have conditional exemptions. This is not a blanket exemption for every organization in those sectors.",
      "sourceId": "ca-ccpa-statute-2026",
      "section": "1798.145(c)-(e); 1798.146"
    },
    {
      "subject": "Sensitive information limits",
      "detail": "Certain permitted purposes and processing without the purpose of inferring characteristics fall outside requests to limit.",
      "sourceId": "ca-ccpa-regulations-2026",
      "section": "7027(a), (m)"
    }
  ],
  "changelog": [
    {
      "version": "2026-10-18.1",
      "date": "2026-10-18",
      "change": "Initial California-only snapshot. Checked current CPPA statute, regulations, and the inflation-adjusted revenue threshold."
    }
  ]
}