California Consumer Privacy Act, as amended by the CPRA

Before or when it collects personal information, a business that controls that collection must tell consumers which categories it will collect, including any sensitive categories, why each is collected or used, whether each is sold or shared, and how long each category will be kept (or the criteria that set the period). It may not later gather new categories, or put existing data to purposes incompatible with those it announced, without first giving a fresh notice. A third party that controls collection may meet this by a prominent notice on its website homepage, and must give the notice at the location when it collects on premises (1798.100(b)).

The notice at collection must be easy to read, accessible and available where the consumer meets it at or before the point data is taken: near web form fields, on app download and settings pages, on paper forms, by signage or orally for in-person or phone collection. It lists categories collected (including sensitive ones), purposes, whether each is sold or shared, retention periods, a link to the opt-out notice where data is sold or shared, and a link to the privacy policy. If the notice is not given, the business may not collect. Where a third party controls collection on another business's site or premises, both must give notice, and a registered data broker that does not collect directly need not give one if it meets the conditions of the section.

A business using or disclosing sensitive data beyond what an average consumer expects for the requested goods or services, or the other purposes the regulations allow (11 CCR 7027(m)), must tell consumers so and let them limit use to those purposes. After a request to limit, the business may use the data only for those purposes unless the consumer later consents. Sensitive data handled with no aim of inferring characteristics about the consumer is treated as ordinary personal information.

Gathering, using, keeping and passing on a consumer's data must go no further than needed, and in proportion, for the purpose it was gathered for, or for another disclosed purpose that fits the context of collection. Processing that drifts into purposes incompatible with those is not allowed.

Any business, whatever its size, must carry out a risk assessment before starting processing that the regulation treats as a significant privacy risk: selling or sharing personal information; processing sensitive personal information (other than routine employee administration such as payroll, benefits, work authorisation and legally required accommodation or wage reporting); using ADMT for a significant decision; automated inference about applicants, students, employees or contractors from systematic observation; automated inference from presence at a sensitive location; and processing data intended to train ADMT for significant decisions or facial, emotion or identity recognition technology. The duty applies to processing begun on or after 1 January 2026; processing already under way then must be assessed by 31 December 2027 (7155(b)).