California privacy laws give residents the right to see what personal information companies hold about them, delete it, correct it, and stop its sale or sharing with third parties. The core of these protections is the California Consumer Privacy Act, as expanded by the California Privacy Rights Act, with additional layers from the state’s data-breach notification statute, the Shine the Light marketing-disclosure law, the California Online Privacy Protection Act, and a new AI training transparency law that takes effect in 2026. Together they treat your personal information as something that belongs to you, not to the company that collected it.
The Rights You Have as a California Resident
Covered businesses must honor a set of consumer rights at no cost. When you send a verifiable request, the company generally has 45 days to respond, and it can take one additional 45-day extension when the request is complex.
Know What a Company Has Collected
You can ask any covered business to tell you the categories of personal information it has collected about you, where it got the data, and what it does with it. The business also has to hand over the specific pieces of information it holds on you when you ask.1California Legislative Information. California Code CIV 1798.100 – General Duties of Businesses that Collect Personal Information
Delete Your Information
You can direct a business to erase personal information it collected from you. Once the request is verified, the company must delete your data from its own records and tell its service providers, contractors, and any third parties it sold or shared the data with to do the same.2California Legislative Information. California Code CIV 1798.105 – Consumers Right to Delete
Correct Inaccurate Records
If a business holds wrong information about you, you can ask it to fix the record, and the business must use commercially reasonable efforts to do so.3California Legislative Information. California Code CIV 1798.106 – Right to Correct
Stop the Sale or Sharing of Your Data
You can tell a business to stop selling your personal information or sharing it with third parties for advertising. After it receives that direction, it cannot sell or share your data unless you later give fresh consent. The business must also notify you up front that your information may be sold or shared.4California Legislative Information. California Code CIV 1798.120 – Right to Opt Out of Sale or Sharing
Limit Use of Sensitive Information
Sensitive personal information includes things like your Social Security number, precise geolocation, racial or ethnic origin, private communications, and health data. You can direct a business to restrict its use of that data to what is necessary to provide the service you actually asked for. Any business that collects sensitive personal information for broader purposes must give you a way to exercise this right.1California Legislative Information. California Code CIV 1798.100 – General Duties of Businesses that Collect Personal Information
No Retaliation for Using Your Rights
A business cannot punish you for exercising any of these rights. That means no denying services, no charging higher prices, no downgrading quality, and no suggesting you will get worse treatment. The law also bars retaliation against employees or job applicants who exercise their privacy rights. Loyalty programs and financial incentives tied to data sharing are allowed, but the value of any discount has to be reasonably related to the value your data provides.5California Legislative Information. California Code CIV 1798.125 – Non-Discrimination
How to Actually Exercise These Rights
Any covered business that sells or shares personal information, or that uses sensitive data beyond what is strictly necessary, must put a link on its homepage titled “Do Not Sell or Share My Personal Information.” A second required link, “Limit the Use of My Sensitive Personal Information,” restricts handling of sensitive data. A business can combine the two into a single clearly labeled link.6California Legislative Information. California Code CIV 1798.135 – Methods of Limiting Sale, Sharing, and Use of Personal Information
You do not have to click those links on every site you visit. The Global Privacy Control is a browser-level signal that automatically tells every site not to sell or share your data, and the California Attorney General has confirmed that businesses must honor it as a valid opt-out under the CCPA.7California Department of Justice. Global Privacy Control (GPC) Sephora paid $1.2 million in 2022 for ignoring GPC signals, and enforcement on this front has continued. Starting January 1, 2027, any company that develops or maintains an internet browser will be required to build opt-out signal functionality directly into the browser.
Which Businesses Have to Listen
The CCPA covers a for-profit company that collects personal information from California residents if it meets any one of three tests: annual gross revenue above $25 million in the preceding calendar year (adjusted for inflation and now roughly $26.6 million as of January 1, 2025); buying, selling, or sharing the personal information of 100,000 or more consumers or households per year; or earning at least half its annual revenue from selling or sharing consumer data.8California Legislative Information. California Code CIV 1798.140 – Definitions
Only one threshold has to be met. A small company that earns under $10 million a year but sells personal information as its primary business model is just as covered as a large corporation that crosses the revenue line. Nonprofits and government agencies are generally outside the CCPA. Any entity controlled by a covered business, or sharing common branding with it, is treated as part of the same business.
Unlike most state privacy laws, California’s CCPA also covers employees, job applicants, independent contractors, and their emergency contacts and beneficiaries. If a for-profit employer meets any of the three thresholds, it owes its workforce the same core access, deletion, and correction rights it gives customers.
Separately, any commercial website or online service that collects personal information from California residents has to post a privacy policy, whether or not the operator is big enough to fall under the CCPA. That requirement comes from the California Online Privacy Protection Act. The policy must disclose the categories of data collected, the categories of third parties it may be shared with, how consumers can review or request changes to their information, how the operator responds to browser “Do Not Track” signals, whether other parties track visitors across sites, how the operator notifies users of material changes, and the effective date of the current policy. An operator that fails to post a compliant policy has 30 days after being notified before it faces liability.9California Legislative Information. California Business and Professions Code 22575 – Privacy Policy Requirements
What Happens After a Data Breach
When a business operating in California discovers that unencrypted personal data was accessed by someone unauthorized, or that encrypted data was taken alongside the key that would unlock it, it must notify every affected California resident. Notice is due within 30 calendar days of discovering the breach. A delay is permitted only if law enforcement says immediate notice would interfere with a criminal investigation, or if the business needs more time to determine the scope and restore its systems.10California Legislative Information. California Code CIV 1798.82 – Data Breach Notification
The notice has to be titled “Notice of Data Breach” and use plain language organized under required headings including “What Happened,” “What Information Was Involved,” “What We Are Doing,” and “What You Can Do.” If you receive one of these notices, it should tell you clearly what was exposed and how to protect yourself.
Find Out Who Bought Your Data for Marketing
California’s Shine the Light law, separate from the CCPA, lets you find out which companies received your personal information for direct marketing. Once per calendar year, you can send a written or email request to a business you have an existing relationship with, asking it to disclose the categories of information it shared with third parties for marketing during the prior year and to name every third party that received it, with addresses.11California Legislative Information. California Code CIV 1798.83 – Customer Records
If you send the request to one of the business’s designated contact methods, it has 30 days to respond. A request sent to a non-designated address still has to be answered, but the deadline stretches to a reasonable period of up to 150 days.11California Legislative Information. California Code CIV 1798.83 – Customer Records
AI Training Data Transparency Starting in 2026
As of January 1, 2026, developers of generative AI systems have to publicly post a high-level summary of the datasets they used to train their models. The Generative Artificial Intelligence Training Data Transparency Act applies to any AI system or service released on or after January 1, 2022, that is made available to Californians, free or paid. The disclosures cover the sources and owners of the training data, whether it includes copyrighted material or personal information, whether the data was purchased or licensed, the time period of collection, and whether synthetic data was used.12California Legislative Information. Assembly Bill 2013 – Generative Artificial Intelligence Training Data Transparency Act
This is a transparency law, not an opt-out. It does not give you the right to pull your data out of an AI training set. What it does is make the training pipeline visible, which can be a starting point for a separate CCPA deletion request against a company that collected your personal information and fed it into a model.
When a Company Breaks the Rules
The California Privacy Protection Agency handles day-to-day CCPA enforcement, with support from the state Attorney General’s office.13CA.gov. California Privacy Protection Agency The agency can investigate complaints, conduct audits, and bring administrative actions. An unintentional violation carries a fine of up to $2,500 per incident; an intentional violation, or any violation involving the personal information of a child under 16, carries up to $7,500 per incident, with periodic inflation adjustments.14California Legislative Information. California Code CIV 1798.155 – Administrative Fines
When You Can Sue on Your Own
Consumers can sue personally in one narrow situation: when unencrypted personal information is exposed because a business failed to maintain reasonable security measures. In that case, you can recover between $100 and $750 per consumer per incident in statutory damages, or your actual damages if higher.15California Legislative Information. California Code CIV 1798.150 – Personal Information Security Breaches
Before filing for statutory damages, you have to send the business written notice identifying which provisions were violated and give it 30 days to cure. If the business actually fixes the problem and provides a written statement that it will not happen again, you cannot proceed with a statutory damages claim for that breach. Patching security after the fact does not count as a cure for the breach that already happened. If the business breaks its written promise, you can sue for damages on each later violation. No advance notice is required if you are suing only for actual financial losses rather than statutory damages.15California Legislative Information. California Code CIV 1798.150 – Personal Information Security Breaches
For violations outside the data-breach context, your route is a complaint to the California Privacy Protection Agency or the Attorney General rather than your own lawsuit.