CCPA / CPRA Compliance Hub

Who Must Comply — Current Business Thresholds

CCPA/CPRA apply to for-profit entities that do business in California, collect California consumers’ personal information, and meet one or more of the following (Civil Code §1798.140(d)(1)):

• Annual gross revenues in excess of $26,625,000 (CPI-adjusted amount effective Jan 1, 2025 under §1798.199.95(d); statutory base was $25M) in the preceding calendar year;
• Annually buys, sells, or shares the personal information of 100,000 or more consumers or households; or
• Derives 50% or more of annual revenues from selling or sharing consumers’ personal information.

The older pre-CPRA “50,000 consumers/households/devices” threshold is no longer the current statutory test.

Consumer Request Clocks

Respond to verifiable requests to know, delete, or correct within 45 days; one extension of an additional 45 days when reasonably necessary with notice in the first period (§1798.130). Regulations also expect acknowledgment within 10 business days.

California security breach notice to residents is under Civil Code §1798.82 (most expedient time / without unreasonable delay) — distinct from CCPA consumer rights. See the breach notification matrix.

Key Explainers & Tools

• What Is CCPA & CPRA? — rights and enforcement overview
• US State Privacy Laws (2026 evergreen) — multi-state map
• CCPA vs Other State Laws
• DSAR / consumer request automation
• CSA Privacy product — inventory, rights clocks, vendors, security evidence
• GDPR hub for parallel EU programmes

CyberSilo’s Compliance Standards Automation platform handles DSAR workflows, data mapping evidence, and security control monitoring from a unified dashboard shared with SOC 2 Privacy criteria and GDPR Article 32 obligations.