US-CCPA-ACCESSIBLE-DISCLOSURESMEDIUMRequirementTransparencyWrite CCPA disclosures in plain language, in the languages the business uses, readable on small screens and accessible to consumers with disabilities
11 CCR § 7003 · Read the full page →
CCPA
California Consumer Privacy Act (as amended by the CPRA)
Californians' rights to know, delete, correct and opt out of the sale or sharing of their personal information, and the duties of the businesses that hold it.
38 obligations in this framework — full source text, applicability logic, and engineering tickets inside Landfall.
38 obligation pages · last updated 6 November 2026
US-CCPA-ADMT-ACCESSHIGHRequirementAutomated DecisionsOn request, explain in plain language how ADMT was used in a significant decision about the consumer
11 CCR § 7222 · Read the full page →
Featured — source excerpt“11 CCR § 7222 (CPPA consolidated regulations effective 2026-01-01, retrieved 2026-10-01), verbatim: "(a) A business that uses ADMT to make a significant decision must provide a consumer with...”
US-CCPA-ADMT-OPT-OUTHIGHRequirementAutomated DecisionsLet consumers opt out of ADMT making significant decisions about them, unless an exception in § 7221(b) such as a human appeal applies
11 CCR § 7221 · Read the full page →
Featured — source excerpt“11 CCR § 7221 (CPPA consolidated regulations effective 2026-01-01, retrieved 2026-10-01), verbatim: "(a) A business must provide consumers with the ability to opt-out of the use of ADMT to make a...”
US-CCPA-ADMT-PRE-USE-NOTICEHIGHDisclosureAutomated DecisionsBefore using automated decisionmaking technology for a significant decision, give consumers a Pre-use Notice explaining the use and their rights to opt out and to access
11 CCR §§ 7200, 7220 · Read the full page →
Featured — source excerpt“11 CCR § 7200 (CPPA consolidated regulations effective 2026-01-01, retrieved 2026-10-01), verbatim: "(a) A business that uses ADMT to make a significant decision concerning a consumer must comply...”
US-CCPA-AUTHORIZED-AGENTSLOWProcessUser RightsAccept requests from authorised agents with signed permission, optionally asking the consumer to verify themselves or confirm the agent
11 CCR § 7063 · Read the full page →
US-CCPA-CYBERSECURITY-AUDITHIGHAssessmentGovernanceComplete an annual cybersecurity audit by a qualified, objective, independent auditor covering the § 7123 components of the business's cybersecurity program
11 CCR §§ 7120, 7122, 7123 · Read the full page →
US-CCPA-CYBERSECURITY-AUDIT-CERTIFICATIONHIGHDisclosureGovernanceComplete the first cybersecurity audit report by 1 April 2028, 2029 or 2030 by revenue band, then certify completion to the CPPA by each 1 April
11 CCR §§ 7121, 7124 · Read the full page →
US-CCPA-DATA-MINIMISATIONHIGHRequirementData CollectionCollect, use, keep and share personal information only as reasonably necessary and proportionate to the disclosed purposes or compatible ones
Civ. Code § 1798.100(c); 11 CCR § 7002 · Read the full page →
US-CCPA-DO-NOT-SELL-LINKCRITICALDisclosureConsentPost a clear and conspicuous "Do Not Sell or Share My Personal Information" link and a Notice of Right to Opt-out of Sale/Sharing
Civ. Code §§ 1798.120(b), 1798.135(a)(1); 11 CCR § 7013 · Read the full page →
US-CCPA-FINANCIAL-INCENTIVE-NOTICEMEDIUMDisclosureTransparencyGive a Notice of Financial Incentive before a consumer opts into a loyalty programme, discount or other incentive for their data, with a good-faith estimate of the data's value
Civ. Code § 1798.125(b); 11 CCR §§ 7016, 7081 · Read the full page →
US-CCPA-LARGE-BUSINESS-METRICSMEDIUMDisclosureGovernanceBusinesses handling the personal information of 10,000,000+ consumers a year must compile and publish annual request metrics by 1 July
11 CCR § 7102 · Read the full page →
US-CCPA-LIMIT-SPI-LINKHIGHDisclosureUser RightsPost a "Limit the Use of My Sensitive Personal Information" link and notice when sensitive personal information is used beyond the permitted purposes
Civ. Code §§ 1798.121, 1798.135(a)(2); 11 CCR § 7014 · Read the full page →
US-CCPA-MINORS-OPT-IN-SALECRITICALProhibitionConsentDo not sell or share personal information of consumers known to be under 16 without their opt-in (13–15) or a verified parent's authorisation (under 13)
Civ. Code § 1798.120(c)–(d); 11 CCR §§ 7070–7072 · Read the full page →
US-CCPA-NO-DARK-PATTERNSHIGHProhibitionDesign DefaultsDesign request and consent methods that are easy to understand, symmetrical in choice and free of dark patterns; consent obtained through a dark pattern is not consent
Civ. Code § 1798.140(h), (l); 11 CCR § 7004 · Read the full page →
US-CCPA-NON-DISCRIMINATIONHIGHProhibitionUser RightsDo not deny goods, charge different prices or give a different quality of service because a consumer exercised a CCPA right
Civ. Code § 1798.125(a); 11 CCR § 7080 · Read the full page →
US-CCPA-NOTICE-AT-COLLECTIONHIGHDisclosureTransparencyGive a notice at or before the point of collection: categories of personal and sensitive personal information, purposes, whether it is sold or shared, and how long it is kept
Civ. Code § 1798.100(a)–(b); 11 CCR § 7012 · Read the full page →
US-CCPA-OPT-IN-AFTER-OPT-OUTMEDIUMRequirementConsentUse a two-step opt-in for consumers returning to sale or sharing after opting out, and wait 12 months before asking them to opt back in
11 CCR § 7028 · Read the full page →
US-CCPA-OPT-OUT-PREFERENCE-SIGNALCRITICALRequirementConsentTreat an opt-out preference signal such as Global Privacy Control as a valid opt-out of sale and sharing, and show the consumer that it was honoured
Civ. Code § 1798.135(b), (e); 11 CCR § 7025 · Read the full page →
US-CCPA-PRIVACY-POLICYHIGHDisclosureTransparencyPublish an online privacy policy describing the business's practices and the consumer's CCPA rights, updated at least once every 12 months
Civ. Code § 1798.130(a)(5); 11 CCR § 7011 · Read the full page →
US-CCPA-REASONABLE-SECURITYCRITICALRequirementData ProcessingProtect personal information with reasonable security procedures and practices; breaches of unencrypted data expose the business to consumer lawsuits with statutory damages
Civ. Code §§ 1798.100(e), 1798.150 · Read the full page →
US-CCPA-REQUEST-METHODSHIGHProcessUser RightsProvide two or more designated methods for requests to know, delete and correct, including a toll-free number (an email address suffices for online-only businesses with a direct relationship)
Civ. Code § 1798.130(a)(1); 11 CCR § 7020 · Read the full page →
US-CCPA-REQUEST-RECORDSMEDIUMRecord KeepingGovernanceKeep records of consumer requests and responses for at least 24 months, securely, and use them only for compliance
11 CCR § 7101 · Read the full page →
US-CCPA-REQUEST-VERIFICATIONMEDIUMProcessUser RightsVerify the identity of people requesting to know, delete or correct, proportionate to the sensitivity of the data, but never for opt-out or limit requests
Civ. Code § 1798.140(ak); 11 CCR §§ 7060–7062 · Read the full page →
US-CCPA-RESPONSE-TIMELINESHIGHProcessUser RightsConfirm receipt within 10 business days and respond within 45 calendar days (one 45-day extension with notice) to requests to know, delete and correct, free of charge
Civ. Code § 1798.130(a)(2); 11 CCR § 7021 · Read the full page →
US-CCPA-RETENTION-LIMITHIGHRequirementData RetentionKeep each category of personal information no longer than reasonably necessary for the disclosed purpose, and disclose the retention period
Civ. Code § 1798.100(a)(3) · Read the full page →
US-CCPA-RIGHT-TO-CORRECTHIGHRequirementUser RightsCorrect inaccurate personal information on a verified request, keep it corrected, and name or notify the source of the inaccurate data
Civ. Code § 1798.106; 11 CCR § 7023 · Read the full page →
US-CCPA-RIGHT-TO-DELETEHIGHRequirementUser RightsDelete a verified consumer's personal information on request, and direct service providers, contractors and third parties to delete it too, unless an exception applies
Civ. Code § 1798.105; 11 CCR § 7022 · Read the full page →
US-CCPA-RIGHT-TO-KNOWHIGHRequirementUser RightsOn a verified request, disclose the categories and specific pieces of personal information collected, sources, purposes and recipients, going back beyond 12 months to 1 January 2022
Civ. Code §§ 1798.110, 1798.115; 11 CCR § 7024 · Read the full page →
US-CCPA-RIGHT-TO-LIMIT-SPIHIGHRequirementUser RightsLet consumers limit the use and disclosure of their sensitive personal information to the permitted purposes, and honour the request within 15 business days
Civ. Code § 1798.121; 11 CCR § 7027 · Read the full page →
US-CCPA-RIGHT-TO-OPT-OUTCRITICALRequirementConsentHonour requests to opt out of the sale or sharing of personal information through two or more methods, within 15 business days, and tell third parties
Civ. Code § 1798.120(a)–(b); 11 CCR § 7026 · Read the full page →
US-CCPA-RISK-ASSESSMENTHIGHAssessmentRisk AssessmentBefore selling or sharing, processing sensitive data, using ADMT for significant decisions, profiling workers, students or people at sensitive locations, or training ADMT or identification technology, conduct a documented risk assessment weighing risks against benefits
11 CCR §§ 7150, 7152, 7154 · Read the full page →
US-CCPA-RISK-ASSESSMENT-ADMT-PROVIDERSMEDIUMDisclosureRisk AssessmentWhen making ADMT or trained identification technology available to other businesses, give them the facts they need for their own risk assessments
11 CCR § 7153 · Read the full page →
US-CCPA-RISK-ASSESSMENT-REVIEW-RETENTIONMEDIUMRecord KeepingRisk AssessmentConduct each risk assessment before the processing starts, review it at least every three years, update it within 45 calendar days of a material change, and keep every version while the processing continues or for five years, whichever is later
11 CCR § 7155 · Read the full page →
US-CCPA-RISK-ASSESSMENT-STAKEHOLDERSMEDIUMProcessRisk AssessmentInvolve the employees who run the processing in its risk assessment, and record any external parties consulted
11 CCR § 7151 · Read the full page →
US-CCPA-RISK-ASSESSMENT-SUBMISSIONHIGHDisclosureRisk AssessmentSubmit risk-assessment information to the CPPA by 1 April 2028 for assessments conducted in 2026 and 2027, then by each 1 April for the previous year
11 CCR § 7157 · Read the full page →
US-CCPA-SERVICE-PROVIDER-CONTRACTSHIGHRequirementData SharingPut a written contract with the CCPA terms in place with every service provider and contractor that receives personal information
Civ. Code § 1798.100(d); 11 CCR §§ 7050–7051 · Read the full page →
US-CCPA-STAFF-TRAININGMEDIUMProcessGovernanceTrain everyone who handles consumer privacy inquiries on the CCPA's requirements and how to direct consumers to exercise their rights
11 CCR § 7100 · Read the full page →
US-CCPA-THIRD-PARTY-CONTRACTSHIGHRequirementData SharingContract with every third party to which personal information is sold or shared, limiting it to specified purposes and binding it to the CCPA and opt-out requests
Civ. Code § 1798.100(d); 11 CCR §§ 7052–7053 · Read the full page →
See how these become your engineering backlog
Landfall turns each of the 38 California Consumer Privacy Act (as amended by the CPRA) obligations into traceable engineering tickets — with full source text, applicability logic, and a citation chain your auditors can follow.