For CCPA as amended by CPRA, engineers build request intake and verification, deletion and correction that reach every system and service provider, opt out of sale or sharing including browser signals, limits on sensitive data use, and an inventory of where personal information lives. Deadlines are 45 days for most requests and 15 business days for opt outs.
Does CCPA apply to you?
The California Attorney General's page says the law applies to for-profit businesses doing business in California that meet any one threshold: annual gross revenue over 25 million dollars, buying, selling or sharing personal information of 100,000 or more California residents or households, or deriving 50 percent or more of annual revenue from selling California residents' personal information. Nonprofits and government agencies are generally not covered. This is a summary of the AG's consumer FAQ and not legal advice, so have counsel confirm whether you are covered.
What rights must the systems support?
The AG lists rights to know, delete, correct, opt out of sale or sharing, limit use of sensitive personal information, and non-discrimination. Requests to know cover the prior 12 months, are free and can be made up to twice a year. Each right maps to something in your stack.
What goes in the technical checklist?
Data inventory. A map of where personal information is collected, stored and sent, including analytics, support tools and backups. Every other item depends on this. Keep it as code or a generated report, not a one off document.
Request intake. At least two request methods, per the AG, with a web based method if you have a website. Log each request with date received, type, identity check, due date and outcome.
Verification. Match the requester to the data without collecting more than you need, and avoid making people create an account to opt out.
Access and portability. A job that gathers a person's data across systems in a readable form, covering the categories, sources, purposes and recipients the law lists.
Deletion. Delete from primary stores, then pass the request to service providers and contractors. Decide how backups age out. Record exceptions such as legal holds. Test with a synthetic user monthly.
Correction. An update path that reaches downstream copies.
Opt out of sale or sharing. A visible link, a flag stored per user or device, and enforcement in tags, SDKs and server calls so third party sharing actually stops. The AG page says opt out preference signals such as a global privacy control must be honoured as valid requests. Test by turning the signal on in a browser and checking network calls.
Sensitive information. Tag data such as financial account numbers or precise location, limit its use to permitted purposes, and offer the right to limit where it applies.
Minors. Opt in before selling data of consumers known to be under 16, with parent consent under 13.
Notice at collection and privacy policy. Show categories and purposes at or before collection, and link the policy. Keep the policy aligned with the inventory.
Deadlines. The AG lists 45 calendar days for requests to know, delete and correct, extendable by another 45 with notice, and no later than 15 business days for opt outs. Build timers and alerts.
What mistakes appear again and again?
- Cookie banners that appear to opt out while tags still fire.
- Deletion that skips analytics warehouses and backups.
- No record that a service provider received the deletion request.
- Verification that demands more data than the business holds.
- Treating the privacy policy as the control rather than the systems.
What to do
- Confirm applicability with counsel.
- Build the data inventory and keep it generated.
- Implement two request methods and a request log with timers.
- Build deletion and correction with service provider propagation.
- Honour global privacy control and test it end to end.
- Tag and limit sensitive data, then review the notice against reality.
Quick check
How long do I have to respond to a CCPA deletion request?
The AG lists 45 calendar days, extendable by 45 more if the business notifies the consumer.
Do I have to honour browser opt out signals?
The AG says opt out preference signals such as a global privacy control must be treated as valid opt out requests.
How Safeguard helps automate this
Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires. Evidence for technical controls is collected from connected systems and code instead of by screenshot, and monitoring runs between reviews. The services and third party libraries in your code, which show where personal data could flow, come from scans, SBOMs and reachability on your real repositories. Safeguard's agent can open tested fix pull requests for vulnerable dependencies. It is off by default, every category starts on Manual, and you choose which categories run automatically and the approval level. Safeguard does not give legal advice or make you compliant. It helps you prepare and keep evidence ready.
Open the framework mapping demo
Sources
- California Attorney General, CCPA, fetched 18 October 2026
Last reviewed: 18 October 2026.
