California Consumer Privacy Act, as amended by the CPRA
California Civil Code, Section 1798.100 and following
- Applies to
- For-profit businesses that do business in California and pass one test: annual revenue above the inflation-adjusted threshold (first set at $25 million), buying, selling or sharing personal information of 100,000 or more consumers or households, or earning half their revenue from selling or sharing it. Employee and job applicant data is covered too.
- What it asks
- People can ask to know, delete and correct their information, opt out of its sale or sharing, and limit use of sensitive information. Businesses answer within 45 days. Regulations adopted in 2025 add risk assessments, cybersecurity audits and rules for automated decision-making, phasing in from 2026.
- What the software does
- Full-text search finds every document that names a person, including HR files. Permissions, retention schedules and an audit trail control who sees it and when it goes.