Most pages about CCPA compliance start with the obligations. That is the second question. The first is whether the statute reaches your business at all, because a large share of the companies worrying about it are below every threshold, and a share of the ones that are not have never checked.
Whether it reaches you
The definition of a covered business is in California Civil Code section 1798.140. It turns on gross revenue, on the number of California consumers or households whose personal information you buy, sell or share, and on the share of revenue you derive from selling or sharing personal information. Read the section rather than a summary of it: the thresholds have moved since the law was passed and secondhand pages are frequently out of date.
The notice at collection
Before or at the point you collect, the person has to be told the categories being collected and the purposes. In practice this is a short line at the form plus the full privacy policy behind it. The mistake is putting everything in the policy and nothing at the form.
The published link
If you sell or share, a clear link is required. Note that share has a specific statutory meaning covering cross-context behavioural advertising, which is why businesses that take no money for data still need the link.
The request routes and the clock
Two or more designated methods for submitting requests, and the response deadline in section 1798.130(a)(2): 45 days from receipt, extendable once by an additional 45 days when reasonably necessary, provided notice of the extension is given inside the first 45-day period.
The vendor terms
The contract with a service provider is what stops your disclosure to them counting as a sale. Vendors without one are the quiet failure here, and the count is usually larger than people expect: the builder on this site walks it.
The record
Requests received and how they were handled. This is the part that turns compliance from a claim into something you can show, and it is the reason a spreadsheet becomes inadequate at about the tenth request.
The rights, listed once
The right to know what personal information is collected, used, shared or sold, and to receive the specific pieces. The right to delete, subject to the exceptions the statute lists. The right to correct inaccurate personal information. The right to opt out of the sale or sharing of personal information. The right to limit the use and disclosure of sensitive personal information. And the right not to be discriminated against for exercising any of them. Each has a request route, a clock and a record behind it, and a business that can handle one properly can handle the others with the same machinery; the record the guide describes is that machinery.
Where the enforcement comes from, and what it costs
The California Privacy Protection Agency and the Attorney General both enforce the statute, and the automatic thirty-day period to cure a violation before enforcement, which the original act provided, no longer applies as of right since the amendments took effect. Administrative fines run per violation, with a higher figure for intentional violations and for violations involving the personal information of consumers under sixteen. A private right of action exists for certain data breaches. For a small business the practical exposure is not the headline fine; it is that a request handled late or a link that is missing is a violation that is easy for anyone to find and easy to show, which is why the record of requests and the published route are the two things to get right first.
Questions people ask about ccpa compliance
Do we comply if we just add a privacy policy?
No. The policy is one of six obligations and the only one that is purely a document. The routes, the clock, the vendor terms and the record are systems, and they are what an enquiry actually tests.
What changed with CPRA?
It amended the CCPA rather than replacing it: it added correction, sensitive personal information as a category, share as a defined term, and a dedicated regulator. Pages that treat them as two separate laws will mislead you.
We are not in California. Does it still apply?
It can. The thresholds are about California consumers, not about where your office is, which is how a company that has never had an employee in the state ends up in scope.