The cost and timeline of CCPA and CPRA compliance depend on four things: whether you are in scope, how many systems hold California residents' personal information, how many consumer requests you receive, and whether the newer risk assessment, audit and automated decision rules apply. A flat price ignores your data flows.
Are you in scope?
The California Attorney General's page says the CCPA applies to for-profit businesses that do business in California and meet any one of three thresholds: gross annual revenue over 25 million dollars, buying, selling or sharing the personal information of 100,000 or more California residents or households, or deriving 50 percent or more of annual revenue from selling California residents' personal information. It generally does not apply to nonprofits or government agencies.
This is the first cost lever, and it is free to check. Many teams spend months building a program before confirming a threshold applies.
What are the main cost drivers?
Data mapping. Every consumer right depends on knowing where the data lives. A company with three systems maps in days. One with dozens of tools and data warehouses may need weeks of interviews.
Request handling. The AG page lists the duties: respond to requests to know, delete and correct within 45 calendar days (extendable by 45 more with notice), honor opt-out requests as soon as feasibly possible and within 15 business days at most, and offer at least two request methods. Low volume can be handled by hand. High volume pushes you toward tooling and staff time.
Notices and opt-outs. A notice at collection, a privacy policy, a "Do Not Sell or Share My Personal Information" link if you sell or share, and honoring a user-enabled global privacy control. These are mostly engineering and legal edits, but they touch every property you run.
Vendors and contracts. Each processor that touches personal information may need contract terms reviewed.
Security. Consumers can sue after certain data breaches caused by a failure to maintain reasonable security, with statutory damages of up to 750 dollars per incident per the AG page. Reasonable security is a cost driver you may already be paying for.
What changed in 2026?
The California Privacy Protection Agency's board adopted regulations on 24 July 2025 that update the existing rules, require certain businesses to conduct risk assessments and complete annual cybersecurity audits, and give consumers rights to access and opt out of the use of automated decision-making technology. The Office of Administrative Law approved them on 22 September 2025, and the effective date is 1 January 2026. The agency's page does not summarize phase-in dates for each obligation, so read the final text for your deadlines.
For teams the effect is that scope and timeline now vary with business type, not only with size.
What to do
- Check the three thresholds with finance and product data before anything else.
- Build a data map: systems, data categories, sources, recipients, retention.
- List the request channels you offer and the volume you expect.
- Identify whether you sell or share personal information, and fix opt-out handling including the global privacy control.
- Review processor contracts, starting with the largest data holders.
- Ask counsel whether the risk assessment, cybersecurity audit or automated decision rules reach you, and read the effective dates in the final regulation.
- Plan staff time for request handling before choosing tools.
- Get fixed-scope quotes from advisers only after the map exists.
Quick check
How fast must a business answer a request to delete?
Within 45 calendar days, and it can extend by another 45 days with notice to the consumer, according to the Attorney General's CCPA page.
Can individuals sue under the CCPA?
For most violations no. Individuals can sue only after certain data breaches caused by a failure to maintain reasonable security, and they must give 30 days written notice to allow a cure.
Sources
- California Attorney General: California Consumer Privacy Act, fetched 18 October 2026.
- California Privacy Protection Agency: CCPA updates, cybersecurity audits, risk assessments, ADMT and insurance regulations, fetched 18 October 2026.
This post gives no prices because none can be quoted without your scope. It is not legal advice.
Last reviewed: 18 October 2026.
