California Consumer Privacy Act (CCPA)
California Consumer Privacy Act (CCPA) in California: active, effective September 2025. Applies to $26.625M+ revenue OR 100K+ consumers OR 50%+ revenue from selling/sharing data AND collecting data from minors under 16. Age range: 13-15. Opt-in consent required for minors 13-15
Key facts
| Jurisdiction | California |
|---|---|
| Category | Consumer Privacy |
| Status | active |
| Effective date | September 2025 |
| Age range | 13-15 |
| Applies to | $26.625M+ revenue OR 100K+ consumers OR 50%+ revenue from selling/sharing data AND collecting data from minors under 16 |
Key requirements
- Opt-in consent required for minors 13-15
- Parental consent for under 13
- Age-Appropriate Design Code (partially revived — see AADC tab)
Notes
California AADC (AB 2273) partially revived by 9th Circuit March 2026 ruling; case back in district court on remand. Legislature passed AB 2246 in August 2026 to replace the AADC with a new children's-privacy framework; awaiting Governor Newsom's action (deadline September 30, 2026).
Frequently asked
What does California Consumer Privacy Act (CCPA) require?
Opt-in consent required for minors 13-15 Parental consent for under 13 Age-Appropriate Design Code (partially revived — see AADC tab)
Who must comply with California Consumer Privacy Act (CCPA) in California?
$26.625M+ revenue OR 100K+ consumers OR 50%+ revenue from selling/sharing data AND collecting data from minors under 16
When does California Consumer Privacy Act (CCPA) take effect and what is its status?
Effective September 2025. Current status: active. California AADC (AB 2273) partially revived by 9th Circuit March 2026 ruling; case back in district court on remand. Legislature passed AB 2246 in August 2026 to replace the AADC with a new children's-privacy framework; awaiting Governor Newsom's action (deadline September 30, 2026).
Related laws
| Law | Jurisdiction | Category | Status | Effective |
|---|---|---|---|---|
| Arkansas Children and Teens' Online Privacy Protection Act (HB 1717) | Arkansas | Consumer Privacy | active | July 1, 2026 |
| California Mental Health Warnings (AB 56) | California | Consumer Privacy | pending | January 1, 2027 |
| Colorado Privacy Act (Minors Amendments) | Colorado | Consumer Privacy | active | October 1, 2025 |
| Connecticut Data Privacy Act (Children's Privacy Amendments) | Connecticut | Consumer Privacy | active | October 1, 2025; Phase 2 July 1, 2026 |
| Delaware Personal Data Privacy Act | Delaware | Consumer Privacy | active | January 1, 2025 |
| Indiana Consumer Data Protection Act | Indiana | Consumer Privacy | active | January 1, 2026 |
| Iowa Consumer Data Protection Act | Iowa | Consumer Privacy | active | January 1, 2025 |
| Kentucky Consumer Data Protection Act | Kentucky | Consumer Privacy | active | January 1, 2026 |
Put it into practice
- Generate the policy: CCPA / CPRA policy generator (generatepolicy.com)
- Buy the policy pack: CCPA CPRA Compliance Bundle (cyberpolicy.shop)
- Build it yourself: CCPA Cybersecurity Audit & Privacy Risk Assessment Kit (ciso.diy)