California's privacy law. Navigate it with confidence.

The CCPA (California Consumer Privacy Act) was the original law, effective January 1, 2020. The CPRA (California Privacy Rights Act), passed by voters in November 2020, significantly expanded the CCPA — adding new consumer rights (right to correct, right to limit sensitive PI), creating the California Privacy Protection Agency (CPPA) to enforce the law, establishing employee data protections, strengthening opt-out requirements, and introducing new rulemaking authority. Most CPRA provisions took effect January 1, 2023. Today, "CCPA compliance" refers to compliance with the CCPA as amended and expanded by the CPRA.

Yes, if you do business in California — which generally means you collect personal information from California residents, including through a website accessible to Californians. Many companies based in Texas, New York, or outside the US entirely are subject to CCPA because they sell to California residents. The revenue threshold ($26.625M as of 2025) applies to global annual gross revenue, not just California revenue. If you're unsure whether CCPA applies, our coverage determination service can give you a definitive answer quickly.

Businesses must respond to verifiable consumer requests within 45 days of receipt. If reasonably necessary, you can extend this by an additional 45 days (90 days total), but you must notify the consumer of the extension within the initial 45-day period. Businesses must also maintain documentation of all consumer requests and their responses for 24 months. Setting up robust workflows, verification procedures, and tracking systems before requests arrive is essential — the timelines are strict and the documentation requirement is easily overlooked.

A service provider is an entity that processes personal information on behalf of a business under a written contract — and that contract must include specific CCPA provisions. Required terms include: processing personal information only for the specified business purpose; prohibiting selling or sharing the personal information; requiring the service provider to assist with consumer rights requests; and imposing the same restrictions on any sub-processors. If your vendor agreements don't include these terms, you remain liable for how that vendor uses the personal information you've shared with them. Service provider agreement review is one of the most common findings in our CCPA assessments.

Dark patterns are user interface design choices that make it difficult for consumers to exercise their privacy rights — for example, burying the "Do Not Sell" link in small text, requiring multiple clicks to opt out while allowing one click to opt in, or using confusing language that misleads consumers about the effect of their choice. The CPPA explicitly prohibits dark patterns and has made enforcement of UI design choices a priority. Our privacy notice reviews specifically check for dark patterns that could trigger CPPA regulatory action, including consent mechanisms, cookie banners, and opt-out flows.

CCPA and GDPR share many common elements — both require transparency, data subject rights, and documented legal bases for processing — but they differ in important ways. GDPR requires a legal basis for every processing activity; CCPA focuses primarily on disclosure and opt-out rights. GDPR's consent requirements are stricter; CCPA gives consumers an opt-out right rather than requiring opt-in consent for most processing. Both have breach notification requirements. Johanson Group designs combined CCPA + GDPR programs that satisfy both simultaneously — sharing documentation, data mapping, and control structures across both frameworks to reduce total compliance cost significantly.