⁦CCPA/CPRA⁩

⁦California, United States⁩ پرائیویسی

حیثیت

⁦In force (CCPA since 1 Jan 2020; CPRA amendments operative 1 Jan 2023). New CPPA regulations on ADMT, risk assessments and cybersecurity audits effective 1 Jan 2026 with phased deadlines.⁩✓ذرائع: ⁦cppa.ca.gov⁩, ⁦cppa.ca.gov⁩, ⁦hunton.com⁩

یہ کن پر لاگو ہوتا ہے

⁦For-profit businesses doing business in California that collect California residents⁩' ⁦personal information and meet a threshold, wherever the business is located. Nonprofits and government agencies are generally not covered.⁩✓⁦Cal. Civ. Code §1798.140(d) ↗⁩ · ذرائع: ⁦oag.ca.gov⁩, ⁦cppa.ca.gov⁩

سائز کی حدیں

⁦Any one of: annual gross revenue over $26,625,000 (CPI-adjusted from $25M on 1 Jan 2025; adjusted every odd-numbered year); buys, sells or shares personal info of 100,000+ California consumers or households; or 50%+ of annual revenue from selling or sharing personal info.⁩✓⁦Cal. Civ. Code §1798.140(d)(1)(A)–(C); §1798.199.95(d) (CPI adjustment; CPPA adjustment eff. 1 Jan 2025) ↗⁩ · ذرائع: ⁦cppa.ca.gov⁩, ⁦cppa.ca.gov⁩, ⁦california.public.law⁩, ⁦fmglaw.com⁩

ریگولیٹر

⁦California Privacy Protection Agency (CPPA, branded⁩ '⁦CalPrivacy⁩'⁦) and the California Attorney General⁩✓⁦Cal. Civ. Code §§1798.199.10, 1798.199.40, 1798.199.90 ↗⁩ · ذرائع: ⁦privacy.ca.gov⁩, ⁦oag.ca.gov⁩

خلاف ورزی یا واقعے کی رپورٹنگ

⁦Civil Code 1798.82 applies to any business doing business in California that holds computerised personal information, whether or not it meets the CCPA thresholds. As amended by SB 446 (from 1 Jan 2026): notify affected residents within 30 calendar days of discovering or being told of a breach (delay allowed for law-enforcement needs or to determine scope); if more than 500 residents must be notified, send the Attorney General a sample notice within 15 calendar days of notifying consumers.⁩✓⁦Cal. Civ. Code §1798.82(a), (c), (f) (as amended by SB 446, Stats. 2025 ch. 319) ↗⁩ · ذرائع: ⁦apcp.assembly.ca.gov⁩, ⁦hyperproof.io⁩

ذاتی ڈیٹا کی درخواستوں کے جواب کی آخری تاریخ

⁦Requests to know, delete or correct: 45 calendar days, extendable once by 45 days (90 total) with notice. Opt-out of sale/sharing: as soon as feasible and no later than 15 business days.⁩✓⁦Cal. Civ. Code §1798.130(a)(2); 11 CCR §7021(b) (45+45 days); 11 CCR §7026(f) (opt-out, 15 business days) ↗⁩ · ذرائع: ⁦oag.ca.gov⁩, ⁦cppa.ca.gov⁩

ڈیٹا پروٹیکشن آفیسر

⁦No statutory DPO requirement. The 2026 regulations require cybersecurity audit results to be reported to executive management and risk assessments to be attested by a responsible executive.⁩⁦no provision (statute); 11 CCR §§7122–7124 (cybersecurity audit, executive certification), §7157 (risk-assessment attestation) ↗⁩

مقامی نمائندہ

⁦No local or in-state representative requirement.⁩⁦no provision ↗⁩

ڈیٹا بیرونِ ملک بھیجنا

⁦No restrictions on transfers outside California or the US; disclosures to service providers, contractors and third parties must be covered by contracts containing CCPA-required terms.⁩⁦no provision on transfers; contract terms: Cal. Civ. Code §§1798.100(d), 1798.140(j), 1798.140(ag); 11 CCR §§7051, 7053 ↗⁩

کوکیز اور رضامندی

⁦Opt-out model: businesses that sell or share personal info (including for cross-context behavioral ads via cookies) must offer a⁩ '⁦Do Not Sell or Share⁩' ⁦option and honor Global Privacy Control as a valid opt-out request. Opt-in consent is required to sell/share data of consumers under 16.⁩✓⁦Cal. Civ. Code §§1798.120(a), (c), 1798.135; 11 CCR §7025 (opt-out preference signals / GPC) ↗⁩ · ذرائع: ⁦oag.ca.gov⁩, ⁦cppa.ca.gov⁩

زیادہ سے زیادہ سزا

⁦Administrative fines/civil penalties up to $2,663 per violation, or $7,988 per intentional violation or violation involving consumers under 16 (from 1 Jan 2025). Data-breach private actions: $107-$799 per consumer per incident or actual damages.⁩✓⁦Cal. Civ. Code §§1798.155(a), 1798.199.90(a), 1798.150(a)(1)(A); §1798.199.95(d) (2025 CPI adjustment) ↗⁩ · ذرائع: ⁦cppa.ca.gov⁩, ⁦fmglaw.com⁩

جن حقائق پر “تصدیق جاری ہے” لکھا ہے ان کی ابھی تصدیق ہو رہی ہے اور انہیں جواب کے طور پر نہیں دیا جاتا۔

آپ کو کیا کرنا ہوگا

• ⁦Post a privacy policy and give a notice at collection listing categories, purposes and retention periods.⁩
• ⁦Answer requests to know, delete and correct within 45 days; process opt-outs within 15 business days.⁩
• ⁦Provide a⁩ '⁦Do Not Sell or Share⁩' ⁦link and honor Global Privacy Control signals.⁩
• ⁦Run and document risk assessments for significant-risk processing; pre-2026 processing must be assessed by 31 Dec 2027.⁩
• ⁦If using ADMT for significant decisions, give pre-use notice, opt-out and access rights by 1 Jan 2027.⁩
• ⁦If in scope, certify an independent cybersecurity audit to the CPPA (first due 1 Apr 2028-2030 by revenue tier).⁩
• ⁦Sign CCPA-compliant contracts with service providers, contractors and third parties.⁩

حالیہ تبدیلیاں

⁦2026 regulations (OAL-approved 22 Sep 2025, effective 1 Jan 2026): ADMT compliance by 1 Jan 2027; risk-assessment attestation due 1 Apr 2028; cyber audits due 1 Apr 2028/2029/2030 by revenue tier. SB 446 30-day breach notice from 1 Jan 2026. Data brokers must use DROP from 1 Aug 2026. Enacted 27 Sep 2026, effective 1 Jan 2027: SB 923 (Stats. 2026, ch. 482) extends the right to delete to personal information collected about a consumer from any source, and businesses operating only online must offer an online request method (such as a web form) as well as an email address; AB 883 (ch. 507) shortens the DROP cycle for data brokers from 45 to 30 days.⁩✓

ذرائع

• بنیادی ذریعہ: ⁦https://cppa.ca.gov/regulations/ccpa_updates.html⁩
• دوسرا ذریعہ: ⁦https://www.thompsoncoburn.com/insights/californias-2026-ccpa-regulations-summary-and-preparation-guide/⁩
• ریگولیٹر: ⁦California Privacy Protection Agency (CPPA, branded⁩ '⁦CalPrivacy⁩'⁦) and the California Attorney General⁩

✓ = دو آزاد ذرائع سے تصدیق شدہ، جن میں کم از کم ایک سرکاری ہے۔ ہم تصدیق کیسے کرتے ہیں

صرف معلومات، قانونی مشورہ نہیں۔ قوانین بدلتے رہتے ہیں؛ اس صفحے پر انحصار کرنے سے پہلے ریگولیٹر یا کسی مستند وکیل سے تصدیق کریں۔ کوئی غلطی نظر آئی؟ ای میل کریں ⁦contact@⁩⁦glancedeskjurisdiction.com⁩.