California’s consumer privacy law, giving residents rights over the personal information businesses collect.

Who does CCPA apply to?

For-profit businesses that do business in California and meet its revenue or data-volume thresholds

What is the current version of CCPA?

CCPA as amended by the CPRA, and the CPPA’s regulations

Who is responsible for CCPA?

California Privacy Protection Agency and the California Attorney General

Framework

CCPA

California Consumer Privacy Act

22 stories in the last 90 days≈ $89.3M in fines tracked (5 actions)Latest story 1 day ago

What is CCPA?: California’s consumer privacy law, giving residents rights over the personal information businesses collect.
Who does CCPA apply to?: For-profit businesses that do business in California and meet its revenue or data-volume thresholds
What is the current version of CCPA?: CCPA as amended by the CPRA, and the CPPA’s regulations
Who is responsible for CCPA?: California Privacy Protection Agency and the California Attorney General

Official text: California Privacy Protection Agency

CCPAHighEnforcement actionUnited States1 day ago

California Attorney General fines Lyft $1.8 million over lack of in-app opt-out

Attorney General Rob Bonta secured a $1.8 million civil penalty against Lyft and ordered an in‑app opt‑out for California consumers.

1 source · official

CCPAHighRule change1 day ago
New York governor signs AI chatbot law restricting minors’ access
Governor Kathy Hochul signed S 9051B into law, banning unsafe AI companion chatbot features for minors in New York, following California’s SB 1119.
1 source · trade press
CCPAHighRule change1 day ago
California extends CMIA protections to health care chatbots and adds AI guardrails
AB 1979, signed into law on 29 October 2026, expands the Confidentiality of Medical Information Act to cover consumer‑facing chatbots and restricts AI use in clinical decision‑making.
1 source · trade press
CCPARegulatory update9 days ago
California Privacy Protection Agency urges House committee to drop AI enforcement moratorium
On 12 May, the California Privacy Protection Agency wrote to the House Energy & Commerce Committee urging it to drop a 10‑year AI enforcement moratorium.
1 source · official
CCPARegulatory update9 days ago
California Privacy Protection Agency, Colorado and Connecticut launch joint sweep of GPC violators
On 21 October 2026 the California Privacy Protection Agency, together with the attorneys general of Colorado and Connecticut, began contacting businesses that have not honored Global Privacy Control opt‑out requests.
1 source · official
CCPAHighRule change9 days ago
California legislature passes AB 566 requiring browsers to embed opt-out signal
California Legislature passed AB 566, requiring all browsers to embed an opt‑out preference signal so consumers can block data sale and sharing with a single setting, now awaiting the Governor's signature.
1 source · official
CCPARegulatory update9 days ago
CalPrivacy warns data brokers to register by 31 January 2027 or face $200 fines
CalPrivacy warns data brokers to register by 31 January 2027, disclose all trade names and websites, and pay fees or face $200 daily fines; DROP launches 1 January 2026.
1 source · official
CCPAHighRule change9 days ago
Governor Newsom signs Opt Me Out Act, requiring browsers opt-out signals by Jan 2027
Governor Newsom signed AB 566, the California Opt Me Out Act, mandating browsers to embed built‑in opt‑out signals for data sharing, taking effect January 2027.
3 sources · 2 official
CCPAHighEnforcement action9 days ago
California privacy agency fines Tractor Supply $1.35 million over applicant failures
Tractor Supply Company must pay a $1.35 million fine, scan digital assets for tracking tech, and certify CCPA compliance annually for four years after a CPPA decision on 21 October 2026.
1 source · official
CCPAHighRule change9 days ago
California Privacy Protection Agency approves Delete Act rules effective 1 January 2026
CalPrivacy approved Delete Act rules; from 1 January 2026 consumers can delete data with one click via DROP, and data brokers must check the platform every 45 days starting 1 August 2026.
1 source · official
CCPAHighEnforcement action10 days ago
Attorney General Bonta secures $6 million settlement from Chrome Holding over genetic data sale
California AG secured a $6 million settlement on 19 October 2026 with Chrome Holding Co. for failing to protect genetic data of ~7 million users and selling it without explicit consent.
3 sources · 1 official
HIPAACCPAHighEnforcement action10 days ago
Conduent proposes $80 million settlement over October 2024 ransomware breach
An $80 million settlement is proposed for Conduent’s October 2024‑January 2025 breach that exposed personal and health data of 62.2 million people, including 40 million in Subclass A and 22 million in Subclass B.
2 sources
CCPAHighRule change22 days ago
CISA submits final CIRCIA rule to OMB for review
CISA sent the final rule implementing the Cyber Incident Reporting for Critical Infrastructure Act of 2022 to OIRA on 1 October 2026, beginning the inter‑agency review before publication.
1 source · trade press
CCPAHighRule change22 days ago
California Attorney General enforces CCPA on employers after exemption ends
The temporary employee exemption in the CCPA expired on 1 January 2023, bringing employee personal information under the law’s full scope for all California employers.
1 source · trade press
CCPAHighRule change24 days ago
California restricts AI employee monitoring tools
Governor Gavin Newsom signed a law on 30 September 2026 banning AI systems that read employee emotions or neural data for workplace surveillance.
1 source · trade press