When general counsel says "we need to be CCPA compliant," engineering gets handed a sentence, not a spec. The California Consumer Privacy Act (CCPA) is a statute plus a 103-page set of regulations, and the items in them don't share a date, an owner or a type of evidence. The dates that matter most haven't arrived, and the earliest is 1 January 2027.
Law firms write the checklists that say what the law requires. This one covers the other half: what the system has to do or produce for each item, with its section, date and who it applies to. It's a builder's read, not legal advice (ivector doesn't give any). Counsel decides whether you're covered. That conversation is row zero.
Who the CCPA covers, and where the CPRA fits
The California Privacy Rights Act (CPRA) is Proposition 24, passed by voters in 2020. It amended the CCPA rather than creating a separate law, and it established the California Privacy Protection Agency to implement and enforce it (CPPA FAQ). So there is one law, the CCPA as amended, and one set of regulations, effective 1 January 2026.
A business is covered if it's run for profit, collects consumers' personal information, does business in California and meets any one of three thresholds (Civil Code 1798.140(d)(1)): gross annual revenue above an inflation-adjusted figure, buying, selling or sharing the personal information of 100,000 or more California consumers or households a year, or getting 50% or more of revenue from selling or sharing it. One is enough. "Consumers" includes California employees and job applicants (the employment and business-to-business exemptions ended 31 December 2022).
The checklist, row by row
The first five rows are the base requirements, in force now. The last five are newer and carry the dates.
| Obligation | Applies to | Section | Date | What engineering produces |
|---|---|---|---|---|
| Notice at collection | Business that controls collection | 7012; Civil Code 1798.100(a) | In force now | A notice at each collection point, backed by a data map |
| Privacy policy | Every covered business | 7011; Civil Code 1798.130(a)(5) | In force now; refresh every 12 months | A policy generated from the data map |
| Requests to know, delete and correct | Every covered business | 7020 to 7024; Civil Code 1798.105, 1798.106, 1798.110 | In force now; confirm in 10 business days, answer in 45 calendar days (7021) | Intake, a queue with both clocks, deletion that reaches vendors, a 24-month log (7101) |
| Opt-out of sale or sharing | Business that sells or shares | 7025, 7026; Civil Code 1798.120, 1798.135 | In force now; stop within 15 business days | A "Do Not Sell or Share" link, opt-out signal handling, third-party notices |
| Service provider contracts | Business that discloses data to vendors | 7051; Civil Code 1798.100(d) | In force now | A vendor register: purpose, contract, last test |
| ADMT rights | Business using ADMT for a significant decision | 7200(b), 7220 to 7222 | 1 January 2027 | Pre-use notice, opt-out flag or appeal path, decision log |
| Risk assessment | Business doing 7150(b) processing | 7150, 7152, 7155(a) | Before processing starts; update within 45 calendar days of a material change | Registry, release gate, description taken from the system |
| Risk assessment, existing processing | Processing begun before 1 January 2026 | 7155(b) | 31 December 2027 | Registry backfilled, versions read-only |
| Risk assessment filing | Businesses with 2026 and 2027 assessments | 7157(a)(1) | 1 April 2028 | Counts pulled from the registry |
| Cybersecurity audit | Business meeting 7120(b) | 7120 to 7124 | Report due 1 April 2028 (top revenue band), 2029 or 2030 | Evidence an auditor can sample |
The base duties: how to tell if "done" is true
Teams treat these as finished because a page exists, but a page isn't the test. Section 7012(d) says a business that skips the notice at or before the point of collection shall not collect the personal information, so a notice written before marketing added two tracking scripts is wrong, not stale. Build one data map that feeds the notice, the policy and the risk assessment.
Requests, opt-outs and vendors fail at the edges. A deletion has to reach your service providers and contractors and, unless that proves impossible or disproportionate, the third parties you sold or shared to (7022(b)). For a business that sells or shares, a qualifying opt-out preference signal, such as an HTTP header, is a valid opt-out request, and a cookie banner alone isn't an acceptable method (7025, 7026(a)(4)). Send the header in staging and watch which ad calls still fire. A service provider contract must give you the right to take reasonable steps to check compliance (7051(a)(6)), and a business that never enforces it might lose the defense that it had no reason to suspect misuse (7051(c)).
The newer duties: ADMT, risk assessments and cybersecurity audits
The automated decisionmaking technology (ADMT) rules apply when a business uses ADMT to make a significant decision about a consumer. Section 7001(ddd) lists five kinds: financial or lending services, housing, education, employment (including compensation) and healthcare. A business already doing this must comply by 1 January 2027 (7200(b)), which means four builds: a pre-use notice shown before the decision (7220), an opt-out or a human appeal route good enough to replace it (7221), a decision log that can answer a person who asks why (7222), and a place for requests to land. The opt-out has a clock: stop within 15 business days and tell your vendors to stop in the same window (7221(n)). A human reviewer only counts if all three parts of 7001(e)(1) hold. See what counts as ADMT and the four builds.
A risk assessment is required for six kinds of processing (7150(b)), among them selling or sharing personal information, processing sensitive personal information, ADMT for a significant decision, and training an ADMT on consumers' personal information. Only the last two exist because of ADMT, so a company with no automated decisions can still owe one. Review the assessment every three years and update it within 45 calendar days of a material change (7155(a)). Keep every version for as long as the processing continues or five years after completion, whichever is later (7155(c)). The filing for 2026 and 2027 reaches the Agency by 1 April 2028, attested by an executive under penalty of perjury (7157(b)(5), (c)). See what goes in one.
Cybersecurity audits are the narrowest. Section 7120(b) covers a business that gets 50% or more of revenue from selling or sharing personal information, or that meets the revenue threshold and processed the personal information of 250,000 or more consumers or households, or the sensitive personal information of 50,000 or more consumers, in the preceding calendar year. It doesn't use the 100,000-consumer threshold, so ask counsel how it applies. First reports are due 1 April 2028, 2029 or 2030, set by top, middle or lowest revenue band (7121(a)).
Don't let 2028 relax you if you're in the top band. Its audit period opens on 1 January 2027, the ADMT date, and findings can't rest primarily on management's assertions (7122(d)), so the controls must already be running and leaving records. The auditor must be independent (7122(a)(2)), so the team that builds your controls can't audit them, and that includes us. Read what the audit asks.
A worked example: a 200-person HR-tech company
An invented company, not a client: a 200-person HR-tech SaaS vendor whose product ranks resumes for its customers' recruiters. Counsel goes first: the customers probably count as the business and the vendor as their service provider, though the vendor is a business itself on its own site and in its own hiring. Engineering starts with a list of systems and what each does with the data.
The marketing site's advertising pixel probably counts as sharing, which means an opt-out link, a signal tested in staging and a 7150(b)(1) risk assessment. The screener is the bigger job. Ranking applicants is an employment decision, and if recruiters work down the list without opening anything the ranking didn't surface, they fail the second part of the involvement test. Customers' contracts will ask for help (7051(a)(5) names ADMT assistance as an example term), so the vendor builds a configurable pre-use notice, a per-candidate decision log (model version, inputs, score, threshold, whether a human looked) and an export that answers an access request.
One wrinkle helps. For hiring, 7221(b)(2) drops the opt-out if the ADMT is used solely to assess ability to perform at work, works for its purpose and doesn't unlawfully discriminate. The notice must still name that exception (7220(c)(2)(B)) and access stays, so the vendor needs an evaluation to show customers. Training on applicants' resumes is a 7150(b)(6) trigger, and counsel decides who owes the assessment. If it processed data on 1.2 million applicants last year, it clears the 250,000 volume test easily. If the revenue threshold is met too, the first audit report lands in 2028, 2029 or 2030, depending on revenue band.
Build the slow things first
Here's the opinion I'd defend on a call: sequence the checklist by what can't be done late, not by what's due first. A notice is a screen, and a team can build it in a sprint once scope is known. A log is time. Every decision made before it ships is one you can't explain to the person who asks. Retention works the same way: audit documents must be kept five years (7122(g)), and a 30-day log default deletes the evidence as fast as you make it. So start with the decision inventory, the log, retention and the release gate that catches a material change inside 45 days, and write the notices last.
That order costs the team that has to instrument a pipeline nobody budgeted for, and it's wrong for a company with no ADMT that doesn't sell or share. There the base duties are a lawyer and a privacy-tooling job, and we're the wrong call.
If counsel puts you in the newer rows, check your ADMT scope, then see ADMT compliance engineering, risk assessment evidence and cybersecurity audit readiness. We build what counsel says you owe, and we can't be your auditor. Tell us what your systems decide and we'll say which rows we'd start with.
Sources
- California Privacy Protection Agency: CCPA regulations, Title 11 Division 6 Chapter 1 (effective 1 January 2026)
- California Privacy Protection Agency: CCPA statute text (effective 1 January 2026)
- California Privacy Protection Agency: Frequently asked questions
- California Privacy Protection Agency: CCPA updates
- California Privacy Protection Agency: CCPA monetary thresholds
