CCPA Requirements in 2026: 8 Live Checks for Notices, Rights, and Proof

The real value in ccpa requirements shows up when you debug it like a live system. A banner can render perfectly and still leak requests, misfire tags, or drift after the next plugin or theme update.

The useful test for ccpa requirements is whether the live stack behaves correctly before consent, after consent, and after the next deployment. That is how hidden leaks and timing mistakes show up.

That is the useful frame in late 2026 because the state baseline is active on several fronts at once. The California Department of Justice still points consumers to core rights to know, delete, correct, opt out of sale or sharing, and limit certain sensitive-personal-information uses. The CPPA says the updated CCPA regulations, plus newer branches for risk assessments, cybersecurity audits, and automated decisionmaking, became effective on January 1, 2026. And enforcement is still practical. On October 29, 2026, Attorney General Rob Bonta announced a $1.8 million Lyft settlement focused on opt-out friction inside the app flow rather than on missing policy language alone.

If you want nearby context first, start with these guides to CCPA compliance, CCPA regulations, and CCPA audit checklist. This page stays narrower. It is the ccpa requirements review I would use this week before telling a leadership team the California program is actually current.

If your team is trying to get ccpa requirements under control without adding a heavyweight privacy stack, DataShyre can help. DataShyre focuses on consent and preference management that are easier to implement, easier to operate, and easier to trust on a live site. Start with DataShyre’s consent and preference management or book a demo.

If your team already knows the law but still struggles to connect notices, request handling, consent choices, and downstream systems, DataShyre can help close the implementation gap through consent management, DSR automation, and risk management. The problem is usually not that the team lacks a policy. It is that the live stack does not consistently do what the policy promises.

1. Reconfirm whether the business is actually in scope

Every serious ccpa requirements review starts with scope, because teams often keep repeating an answer that was never refreshed.

The CPPA FAQ says the law generally applies to covered for-profit businesses doing business in California that meet at least one of three common tests:

1. gross annual revenue of $26.625 million or more for the preceding calendar year;
2. buying, selling, or sharing the personal information of 100,000 or more California residents or households; or
3. deriving 50% or more of annual revenue from selling or sharing California residents’ personal information.

That first number matters because it is not the old $25 million figure anymore. The CPPA’s current CPI-adjustment page says the updated revenue threshold took effect on January 1, 2025.

So the first ccpa requirements check is not just Does California apply? It is:

1. which legal entity is in scope;
2. which threshold creates that scope;
3. which sites, apps, brands, and data flows sit inside that answer; and
4. whether the answer changed since the last audit.

If the scope map is fuzzy, every later control tends to be fuzzy too.

2. Match notice at collection and the privacy policy to the live collection flow

The California DOJ still says consumers must receive a notice at collection that tells them, at or before the point of collection, about the categories of personal information collected and the purposes for which they will be used.

That requirement sounds simple until you compare it with a modern stack.

A useful ccpa requirements review should compare the notice layer against the real inputs:

1. forms and checkout pages;
2. account creation and login surfaces;
3. mobile SDKs and in-app prompts;
4. analytics and advertising tags;
5. customer-support or scheduling tools; and
6. any enrichment or sharing flow that starts immediately after collection.

The privacy policy matters too. The DOJ and CPPA both still point people to the policy for rights instructions and broader privacy details. But the policy is not the control by itself. The alignment between the notice layer and the live stack is the control.

3. Make opt-out of sale or sharing work where the data actually moves

This is one of the easiest places for ccpa requirements to look correct on paper and fail in production.

California’s DOJ still says consumers can opt out of sale or sharing, including through a user-enabled Global Privacy Control. Its current GPC page calls that signal a:

“stop selling or sharing my data switch”

>

California Department of Justice

That should turn your review into a runtime test, not a design review.

Check whether:

1. the business actually sells or shares personal information at all;
2. the opt-out method is clear and easy to find;
3. GPC is detected and honored where required;
4. downstream ad-tech, enrichment, and partner flows change after the request; and
5. the effect carries across the actual account or service surface where the data sharing happens.

The hard part is not placing the link. The hard part is making sure the choice travels as far as the data does.

4. Remove dark patterns from the choice architecture

A lot of ccpa requirements risk is interface risk now.

The CPPA Enforcement Division’s dark-pattern advisory tells businesses to offer “symmetrical choices” and use clear, understandable language when presenting privacy choices.

That means your ccpa requirements review should test whether the live interface:

1. makes refusal harder than acceptance;
2. buries the opt-out path behind extra taps or screens;
3. uses vague labels that hide the effect of the choice;
4. breaks on mobile or logged-in surfaces; or
5. pressures the user back into opting in right after they opted out.

If the flow is lopsided or manipulative, the problem is already live, even if the footer copy looks polished.

5. Treat request methods and deadlines as operating requirements

Many teams can describe the rights. Fewer can run them cleanly.

The California DOJ’s consumer guidance says businesses must designate methods for people to submit requests. The CPPA FAQ says businesses must confirm receipt of delete, correct, or know requests within 10 business days and substantively respond within 45 calendar days, with one extension of up to another 45 days when they provide notice. The same FAQ says opt-out of sale or sharing and requests to limit certain sensitive-personal-information uses must be processed as soon as feasibly possible, up to a maximum of 15 business days.

That should change how you review ccpa requirements. Do not ask only whether a webform exists. Ask whether the business can show:

1. the designated intake paths;
2. routing from intake to fulfillment;
3. identity-verification logic where needed;
4. timestamps for confirmation and completion; and
5. evidence that the fulfillment actually changed the underlying systems.

This is where a lot of privacy programs stop being theoretical.

6. If you are a data broker, treat the Delete Act branch as current work

Not every business needs this branch. But for the businesses that do, it is very much current.

The CPPA’s data-broker materials say Californians can use the Delete Request and Opt-out Platform (DROP), and that beginning August 1, 2026, data brokers must access the platform at least once every 45 days and process consumer deletion requests, subject to limited exceptions.

So if a business falls into that category, the ccpa requirements review needs a separate branch for:

1. registration status;
2. DROP access and download procedures;
3. deletion processing cadence;
4. exception handling; and
5. proof that the broker and its downstream recipients actually acted on the request.

This is a good example of why copied CCPA summaries go stale. A generic article written in 2024 can miss a live 2026 operational obligation entirely.

7. Keep records long enough to prove what happened

The official California regulations still require businesses to maintain records of consumer requests and how they responded for at least 24 months.

That is important because many ccpa requirements failures are not failures of theory. They are failures of evidence.

A useful review asks whether you can actually produce:

1. the request record;
2. the verification outcome;
3. the system or vendor action taken;
4. the completion date; and
5. the notice or message sent back to the consumer.

If the answer depends on screenshots scattered across inboxes and spreadsheets, the requirement may exist on paper but not in a durable way.

8. Use current enforcement as a realism check

The best recent reminder is Lyft.

On October 29, 2026, the California Attorney General announced a $1.8 million settlement with Lyft, alleging the company sold or shared data for targeted advertising without giving users an in-app opt-out path. The announcement said consumers had to detour through the privacy policy and extra steps, which the state called an “illegal and unnecessary barrier” to exercising CCPA rights.

That matters because it resets the practical lesson for ccpa requirements in one sentence:

California is not only checking whether the right exists.

California is checking whether a real person can actually use it inside the real service.

A practical 8-step CCPA requirements review for this week

If I were auditing ccpa requirements this week, I would use this order:

1. confirm the current scope threshold and covered entities;
2. compare notice at collection against the actual collection points;
3. test whether sale or sharing really occurs in production;
4. verify the opt-out path and GPC behavior end to end;
5. review screens and flows for dark-pattern risk;
6. measure intake, confirmation, and completion timing for consumer requests;
7. add the Delete Act branch if the business is a data broker; and
8. collect durable evidence that can still be produced later.

That order surfaces more truth than either a legal memo alone or a banner screenshot alone.

FAQ

What are the main CCPA requirements in 2026?

At a practical level, the main ccpa requirements are: determining scope correctly, giving a notice at collection, posting an accurate privacy policy, offering usable rights-request methods, honoring opt-out of sale or sharing including GPC where required, avoiding dark patterns, meeting response deadlines, and keeping proof of what happened.

Does every business need to worry about the DROP system?

No. That branch is specific to data brokers. But if your business is a data broker, it is not optional background reading anymore. It is a live 2026 operating requirement.

Is a privacy policy enough to satisfy CCPA requirements?

No. A privacy policy is necessary, but it does not replace runtime controls, request handling, downstream vendor action, or evidence that the user’s choice changed what the system did.

Bottom line

The safest way to think about ccpa requirements in 2026 is not policy plus footer link.

It is scope, notices, runtime choice handling, request operations, evidence, and current California enforcement expectations.

If the live business can show all of that cleanly, the program is probably in much better shape than most.

If it cannot, the problem is usually not the wording.

The fastest way to judge ccpa requirements is to test it the way a broken deployment would expose it: before consent, after consent, and again after a stack change.

Sources

• California Department of Justice, California Consumer Privacy Act (CCPA): https://oag.ca.gov/privacy/ccpa
• California Department of Justice, Global Privacy Control (GPC): https://oag.ca.gov/privacy/ccpa/gpc
• California Privacy Protection Agency, FAQs: https://cppa.ca.gov/faq
• California Privacy Protection Agency, Updated Monetary Thresholds in CCPA: https://cppa.ca.gov/regulations/cpi_adjustment.html
• California Privacy Protection Agency, CCPA Updates, Cybersecurity Audits, Risk Assessments, Automated Decisionmaking Technology (ADMT), and Insurance Regulations: https://cppa.ca.gov/regulations/ccpa_updates
• California Privacy Protection Agency, Enforcement Advisory No. 2024-02: https://cppa.ca.gov/pdf/enfadvisory202402.pdf
• California Privacy Protection Agency, Delete Request and Opt-out Platform (DROP): https://cppa.ca.gov/data_brokers/
• California Privacy Protection Agency, CCPA – Effective January 1, 2026: https://cppa.ca.gov/regulations/pdf/ccpa_statute_eff_20260101.pdf
• California Department of Justice, Privacy Rights Can’t Be Left in the Rearview: Attorney General Bonta Secures $1.8 Million Settlement with Lyft: https://oag.ca.gov/news/press-releases/privacy-rights-can%E2%80%99t-be-left-rearview-attorney-general-bonta-secures-18-million