California's Privacy Law Takes Effect

What Changed

The California Consumer Privacy Act (CCPA) took effect on January 1, 2020. The California Department of Justice summarizes the rights it created.¹ It gave California residents rights over the personal information businesses collect about them, including:

• the right to know what personal information a business collects and how it's used and shared;
• the right to delete personal information (with some exceptions);
• the right to opt out of the sale of their personal information.

In November 2020, California voters approved Proposition 24, the California Privacy Rights Act (CPRA), which amended the CCPA from January 1, 2023. It added the right to opt out of "sharing" personal information as well as selling it, and rights to correct data and to limit the use of sensitive personal information. Consumers can opt out through a user-enabled global privacy control, a browser signal that applies to every site.

Why It Mattered

California's size made the CCPA a national standard in practice. Many businesses applied its rights to all US users rather than build a separate process for one state.

For advertising, the key question was whether passing data to ad tech partners counted as a "sale". Much of the industry treated it that way, which brought "Do Not Sell My Personal Information" links to websites and opt-out signals into the ad supply chain. The CPRA's addition of "sharing" was aimed directly at cross-context behavioural advertising, removing much of the ambiguity.

Enforcement followed. In August 2022 California's attorney general announced a $1.2 million settlement with Sephora, the first public CCPA enforcement action.² Sephora had not disclosed that it sold personal information, and had not honoured opt-outs sent through Global Privacy Control.

The CPRA also created a dedicated regulator, the California Privacy Protection Agency. In March 2025 it fined Honda $632,500, in part because Honda's cookie tool didn't offer privacy choices in a symmetrical way and because it shared personal information with ad tech companies without contracts containing the required terms.³

California has also gone after data brokers. Under its Delete Act, residents can ask every registered data broker to delete their data in one request through a state platform, DROP, and from August 1, 2026 brokers must process those requests.⁴

Other States Followed

Virginia was the first state to follow California, and others came in waves. By the date each law took effect:^5,6,7

• 2023: Virginia (January 1), Colorado and Connecticut (July 1), Utah (December 31).
• 2024: Oregon and Texas (July 1), Montana (October 1).
• 2025: Delaware, Iowa, Nebraska and New Hampshire (January 1), New Jersey (January 15), Tennessee (July 1), Minnesota (July 31), Maryland (October 1).
• 2026: Indiana, Kentucky and Rhode Island (January 1).
• Coming: Oklahoma (January 1, 2027) and Alabama (May 1, 2027).

Most follow the same model: residents can access, correct and delete their data, and opt out of its sale and of targeted advertising. By early 2026, at least a dozen state laws required businesses to honour opt-out signals such as Global Privacy Control, and regulators in several states had begun coordinated investigations of companies that ignored them. Maryland's law is among the strictest, limiting how personal data can be processed rather than relying on consent.⁷