Data Privacy · California
California Consumer Privacy Act / CPRA
AB 375 / Prop 24 - enacted in California.
- Status
- Enacted
- Enacted
- 2018
- States with data privacy laws
- 21
- California tracker score
- 100/100 Top 10%
The bottom line
California Consumer Privacy Act / CPRA is an enacted law in California, part of a mature, broadly-adopted data privacy landscape.
- Enacted
- effective 2020-01-01
- 21
- states have data privacy laws
- 21/21
- data privacy laws enacted nationally
- 100/100
- California tracker score
Data compiled 2026-03-18 from the official California legislative record linked below; laws can be amended or repealed after this date.
Category catalog share · regulations
How 21 tracked data privacy records split by state
Exclusive California vs other-state counts in this category (sum to the category total). Orthogonal to the peer scatter below, which plots enacted volume against portal tracker score.
Regulatory Snapshot: California Consumer Privacy Act / CPRA
California Consumer Privacy Act / CPRA (AB 375 / Prop 24) is an enacted law in California under the Data Privacy category. It was enacted on 2018-06-28 and becomes effective on 2020-01-01. California currently has 12 regulations tracked here, with 12 records marked enacted in this dataset. PlainRegWatch's tracker score is 100/100; it summarizes coverage within the five categories this site tracks and is not an official state rating. PlainRegWatch compiled this entry's data on 2026-03-18; consult the linked official source for the current, authoritative text.
Nationally, 21 data privacy statutes have been enacted and 0 additional bills remain pending - 21 distinct jurisdictions have codified rules in this area so far. That places California within a mature and broadly adopted data privacy landscape where compliance programs typically hinge on definitions in AB 375 / Prop 24 itself.
Applicability under California Consumer Privacy Act / CPRA: Business in CA with $25M+ revenue, or 100K+ consumers data, or 50%+ revenue from data sales. Penalty exposure is documented as: $2,500/unintentional, $7,500/intentional violation. Private right of action for breaches: $100-$750/consumer. Notable exemptions: Employee data (partial), B2B (partial), HIPAA, GLBA entities..
Summary
Most comprehensive US state privacy law. Right to know, delete, opt out of sale. CPRA added correction rights, CPPA agency, data minimization.
Key Requirements
- Right to know, delete, opt out of sale/sharing, correct data; data minimization; purpose limitation; mandatory privacy notices; data processing agreements; annual risk assessments.
Penalties
- $2,500/unintentional, $7,500/intentional violation.
- Private right of action for breaches: $100-$750/consumer.
Applicability
- Business in CA with $25M+ revenue, or 100K+ consumers data, or 50%+ revenue from data sales.
Exemptions
- Employee data (partial), B2B (partial), HIPAA, GLBA entities.
Official Source
https://oag.ca.gov/privacy/ccpaCategory context
How California sits among data privacy peers
21 states have a tracked record in data privacy ; California ranks #1 by portal tracker score among those peers. Each point is one state with at least one data privacy regulation in this archive.
Read the peer-state figures
- California (this state): 1 enacted of 1 tracked data privacy record, tracker score 100/100.
- Colorado: 1 enacted of 1 tracked data privacy record, tracker score 76/100.
- Texas: 1 enacted of 1 tracked data privacy record, tracker score 69/100.
- Connecticut: 1 enacted of 1 tracked data privacy record, tracker score 62/100.
- Minnesota: 1 enacted of 1 tracked data privacy record, tracker score 62/100.
- Oregon: 1 enacted of 1 tracked data privacy record, tracker score 62/100.
- Delaware: 1 enacted of 1 tracked data privacy record, tracker score 59/100.
- Virginia: 1 enacted of 1 tracked data privacy record, tracker score 59/100.
- Utah: 1 enacted of 1 tracked data privacy record, tracker score 55/100.
- Florida: 1 enacted of 1 tracked data privacy record, tracker score 48/100.
- Maryland: 1 enacted of 1 tracked data privacy record, tracker score 48/100.
- New Jersey: 1 enacted of 1 tracked data privacy record, tracker score 48/100.
- Rhode Island: 1 enacted of 1 tracked data privacy record, tracker score 48/100.
- Vermont: 1 enacted of 1 tracked data privacy record, tracker score 48/100.
- Indiana: 1 enacted of 1 tracked data privacy record, tracker score 31/100.
- Iowa: 1 enacted of 1 tracked data privacy record, tracker score 31/100.
- Kentucky: 1 enacted of 1 tracked data privacy record, tracker score 31/100.
- Montana: 1 enacted of 1 tracked data privacy record, tracker score 31/100.
- Nebraska: 1 enacted of 1 tracked data privacy record, tracker score 31/100.
- New Hampshire: 1 enacted of 1 tracked data privacy record, tracker score 31/100.
- Tennessee: 1 enacted of 1 tracked data privacy record, tracker score 31/100.
Dashed lines mark the peer averages in this category. The tracker score summarizes enacted records across all five policy areas PlainRegWatch tracks; it is not enforcement strength or legal burden. Read how tracker scores are computed.
Tracker-score ranking on data privacy
Top peer states by portal tracker score among jurisdictions with a data privacy record in this archive.
| # | State | Tracker score |
|---|---|---|
| 1 | California (this state) | 100 |
| 2 | Colorado | 76 |
| 3 | Texas | 69 |
| 4 | Connecticut | 62 |
| 5 | Minnesota | 62 |
| 6 | Oregon | 62 |
| 7 | Delaware | 59 |
| 8 | Virginia | 59 |
| 9 | Utah | 55 |
| 10 | Florida | 48 |
Read with California Consumer Privacy
Nearest data privacy volume peers and same-state archive siblings for this ENACTED · DENSE row.
ENACTED DENSE
Colorado · 1 enacted
Colorado holds 1 enacted data privacy rows (more by 0 than California); tracker 76/100.
Texas · 1 enacted
Texas holds 1 enacted data privacy rows (more by 0 than California); tracker 69/100.
Connecticut · 1 enacted
Connecticut holds 1 enacted data privacy rows (more by 0 than California); tracker 62/100.
Minnesota · 1 enacted
Minnesota holds 1 enacted data privacy rows (more by 0 than California); tracker 62/100.
California AI Transparency Act · ENACTED
Another California archive row (AI Regulation) stamped ENACTED beside ENACTED California Consumer Privacy.
Generative AI Training Data Transparency Act · ENACTED
Another California archive row (AI Regulation) stamped ENACTED beside ENACTED California Consumer Privacy.
Disclaimer: This summary is provided for informational purposes only and does not constitute legal advice. Regulation details may have changed since this data was compiled (2026-03-18). Always consult official sources and qualified legal counsel for compliance guidance.
Read our methodology - how this data is sourced, computed, and verified.
Verify with the official California source →
Every figure on PlainRegWatch is rendered from curated state legislative and Federal Register source data, no number is typed in by an editor. Status, dates, and source URL are this record's row in the curated archive, not a live legislature scrape. See our editorial standards & corrections policy, the methodology behind these numbers, or report a data error. Data current as of July 2026. Tracker scores and rule counts are curated records in five tracked categories - not enforcement strength, legal advice, a complete inventory of US law, or a live bill-status feed.