If a regulator or customer asks about CCPA and CPRA, have these ready: your notice at collection and privacy policy, a log of consumer requests with dates and outcomes, proof you honor opt-out signals, and your service provider and contractor terms. There is no CCPA certificate. The question is whether you can show what you did.
Who asks, and what is the standard?
The California Attorney General's CCPA page explains that the Attorney General and the California Privacy Protection Agency can take legal action against businesses that do not comply. Consumers generally cannot sue for CCPA violations, apart from certain data breaches of unencrypted, unredacted information caused by unreasonable security. The Attorney General uses consumer complaints to identify patterns of misconduct.
So the realistic trigger is a complaint or an inquiry, and the realistic first request is "show us." This is also what enterprise customers mean when they send a privacy questionnaire.
Does the law apply to you?
The AG's page lists three thresholds for for-profit businesses doing business in California: more than 25 million dollars in annual gross revenue, buying, selling or sharing the data of 100,000 or more residents or households, or earning 50 percent or more of revenue from selling personal information. Confirm applicability with counsel; this post is not legal advice.
What evidence is worth having?
Notices. The notice at collection, the privacy policy, and where applicable the "Do Not Sell or Share My Personal Information" link, each with a change history so you can show what was live on a given date.
Request handling. The AG page sets response timing: 45 calendar days for requests to know, delete and correct, extendable by 45 more days with notice, and 15 business days for opt-out requests. A log with request date, type, how it was received, response date and outcome shows you met those deadlines. Practitioner sources describe a 24 month retention period for these records, but we could not confirm the current regulation text, so check it with counsel before you set retention.
Opt-out signals. The page says businesses must honor opt-out signals sent through a global privacy control. Keep a test result showing that a browser sending the signal gets the opted-out experience, with a date.
Request channels. At least two methods, typically including a toll-free number, though online-only businesses may offer email alone. Keep a screenshot or configuration record.
Contracts. Agreements with service providers and contractors that limit how they use personal information.
Reasonable security. The private right of action for breaches turns on reasonable security, so keep the evidence that your technical controls were in place: access reviews, patching records, and for software you ship, an inventory of components and a record of how you handled known vulnerabilities.
What can a tool do here?
Some, not all. Safeguard's CCPA and CPRA framework page says each product scan checks four requirements against the scan findings and software inventory: data processor documentation, privacy-relevant component identification, third-party component transparency and SBOM creator accountability. It also lists 14 catalog controls covering consumer rights, notices, sensitive data tracking, reasonable security, risk assessment and service provider data use, which you evidence yourself with tests, uploads, policies or attestation. The page says no automated tests map to this framework directly, and it does not say Safeguard certifies CCPA or CPRA compliance. It does not, and neither does any readiness score.
What to do
- Confirm with counsel whether the thresholds apply to you.
- Start a request log today if you do not have one, with the fields above.
- Test global privacy control handling and save dated proof.
- Collect signed service provider terms into one folder.
- Keep dated versions of every notice and policy.
- Pull your component inventory and vulnerability history as part of the security evidence.
Quick check
Is there a CCPA certification?
No. The Attorney General and the California Privacy Protection Agency enforce the law. Evidence is how you show compliance.
How fast must you answer a deletion request?
Within 45 calendar days, extendable by 45 more with notice, per the Attorney General's page.
Sources
- California Attorney General, California Consumer Privacy Act
- Safeguard docs, CCPA and CPRA framework
- Safeguard docs, How framework coverage works
Last reviewed: 18 October 2026.
