Data Privacy · California
California Consumer Privacy Act / CPRA
AB 375 / Prop 24 - enacted in California.
- Enacted
- Status
- 2018
- Enacted
- 21
- States with data privacy laws
- 100/100
- California strictness
The bottom line
California Consumer Privacy Act / CPRA is an enacted law in California, part of a mature, broadly-adopted data privacy landscape.
- Enacted
- effective 2020-01-01
- 21
- states have data privacy laws
- 21/21
- data privacy laws enacted nationally
- 100/100
- California strictness score
Data compiled 2026-03-18 from the official California legislative record linked below; laws can be amended or repealed after this date.
Regulatory Snapshot: California Consumer Privacy Act / CPRA
California Consumer Privacy Act / CPRA (AB 375 / Prop 24) is an enacted law in California under the Data Privacy category. It was enacted on 2018-06-28 and becomes effective on 2020-01-01. California currently reports 12 tracked regulations with 12 already in force, giving the state a regulatory strictness score of 100/100 relative to the national baseline. PlainRegWatch compiled this entry's data on 2026-03-18; consult the linked official source for the current, authoritative text.
Nationally, 21 data privacy statutes have been enacted and 0 additional bills remain pending - 21 distinct jurisdictions have codified rules in this area so far. That places California within a mature and broadly adopted data privacy landscape where compliance programs typically hinge on definitions in AB 375 / Prop 24 itself.
Applicability under California Consumer Privacy Act / CPRA: Business in CA with $25M+ revenue, or 100K+ consumers data, or 50%+ revenue from data sales. Penalty exposure is documented as: $2,500/unintentional, $7,500/intentional violation. Private right of action for breaches: $100-$750/consumer. Notable exemptions: Employee data (partial), B2B (partial), HIPAA, GLBA entities..
Summary
Most comprehensive US state privacy law. Right to know, delete, opt out of sale. CPRA added correction rights, CPPA agency, data minimization.
Key Requirements
Right to know, delete, opt out of sale/sharing, correct data; data minimization; purpose limitation; mandatory privacy notices; data processing agreements; annual risk assessments.
Penalties
$2,500/unintentional, $7,500/intentional violation. Private right of action for breaches: $100-$750/consumer.
Applicability
Business in CA with $25M+ revenue, or 100K+ consumers data, or 50%+ revenue from data sales.
Exemptions
Employee data (partial), B2B (partial), HIPAA, GLBA entities.
Official Source
https://oag.ca.gov/privacy/ccpaHow California compares on data privacy
21 states regulate data privacy - California ranks #1 by overall regulatory strictness. Bar = state strictness score (0–100).
| # | State | Strictness |
|---|---|---|
| 1 | California (this state) | 100 |
| 2 | Colorado | 76 |
| 3 | Texas | 69 |
| 4 | Connecticut | 62 |
| 5 | Minnesota | 62 |
| 6 | Oregon | 62 |
| 7 | Delaware | 59 |
| 8 | Virginia | 59 |
| 9 | Utah | 55 |
| 10 | Florida | 48 |
Frequently Asked Questions
Which states have data privacy regulations?
As of the last verification, 21 states have enacted data privacy regulations, with 0 additional bills pending across other states. California is among the states that has enacted such legislation. Browse all data privacy regulations at plainregwatch.com for the complete state-by-state comparison.
When was California Consumer Privacy Act / CPRA enacted?
California Consumer Privacy Act / CPRA was enacted on 2018-06-28 and became effective on 2020-01-01. It was introduced as AB 375 / Prop 24.
What are the penalties for violating California Consumer Privacy Act / CPRA?
$2,500/unintentional, $7,500/intentional violation. Private right of action for breaches: $100-$750/consumer. Note that enforcement mechanisms and penalty structures may vary. Consult the official statute and qualified legal counsel for specific compliance requirements.
Does California Consumer Privacy Act / CPRA apply to small businesses?
Business in CA with $25M+ revenue, or 100K+ consumers data, or 50%+ revenue from data sales. Many state regulations include thresholds or exemptions for smaller organizations. Review the full applicability criteria and consult legal counsel to determine your obligations.
How does California compare to other states on data privacy?
California has a regulatory strictness score of 100/100, based on 12 enacted regulations out of 12 tracked. Nationally, 21 states have enacted data privacy laws. Visit our state comparison page for a full ranking.
Where can I read the full text of California Consumer Privacy Act / CPRA?
The official text of California Consumer Privacy Act / CPRA (AB 375 / Prop 24) is available from the California legislature. PlainRegWatch links to the official source for every tracked regulation. We recommend reviewing the full statute alongside qualified legal counsel for compliance planning.
Regulation Guides
Plain-language guides to help you understand the broader regulatory landscape.
Explore Regulations
Disclaimer: This summary is provided for informational purposes only and does not constitute legal advice. Regulation details may have changed since this data was compiled (2026-03-18). Always consult official sources and qualified legal counsel for compliance guidance.
More California Regulations
The bottom line
This law is already in force - here's what matters for data privacy compliance.
- California Consumer Privacy Act / CPRA is enacted in California, effective 2020-01-01. Official source
- 21 states now regulate data privacy; California ranks #1 by strictness - compare requirements before you operate across state lines. Compare states
- See every regulation California tracks across all five policy areas. California profile
Summaries are general information, not legal advice; always confirm against the official statute and qualified counsel.
Read our methodology - how this data is sourced, computed, and verified.
Related
Verify with the official California source →
Every figure on PlainRegWatch is rendered directly from state source data, no number is typed in by an editor. This page draws directly on federal and state source data, no figure is typed in by an editor. See our editorial standards & corrections policy, the methodology behind these numbers, or report a data error.