The California Consumer Privacy Act applies to for-profit businesses that do business in California and meet a revenue, data-volume or data-sale threshold. For a VP of engineering, the practical work is a data map and request tooling: you must be able to find, return, correct and delete a person's data across systems.
Does it apply to you?
The California Attorney General's page says the CCPA applies to for-profit businesses that do business in California and meet any one of three tests: gross annual revenue over 25 million dollars; buying, selling or sharing the personal information of 100,000 or more California residents or households; or deriving 50 percent or more of annual revenue from selling California residents' personal information.
Thresholds and definitions can be adjusted, so confirm the current figures on the Attorney General's site and with counsel before you decide you are out of scope.
What rights must the stack support?
The Attorney General's guidance describes consumer rights including knowing what personal information a business collects, deleting it, correcting it, and opting out of its sale or sharing. Each right is an engineering requirement.
- Access. Can you assemble every record tied to one person across the application database, analytics, support tools, backups and logs?
- Deletion. Can you delete or de-identify across all of them, and tell downstream processors to do the same?
- Opt-out. Can a browser signal or a user setting stop sale or sharing everywhere it matters, including ad and analytics tags?
Where do teams fail?
A constructed example: a retailer deletes a user from its main database but leaves the same email in a marketing platform, a support desk and a data warehouse export. The deletion request is technically "done" and substantively not. The data map was the missing piece.
Another common failure is shadow collection, such as a front-end tag added by marketing that sends identifiers to a third party. Engineering often learns of it only when the request arrives.
How should request handling be built?
Treat it as a product with a queue, not an email inbox. A request arrives, identity is verified, a job fans out to each system on the data map, each system returns or deletes, and the result is logged with timestamps. Keep the deadline clock visible so nothing ages out unnoticed. Check the Attorney General's guidance for the current response timeframes and verification expectations rather than hardcoding numbers from memory.
Plan for exceptions too. Some data may be kept for legal or security reasons, and the response must say so accurately. Build a place to record each exception with its reason, so the answer you give a person matches what your systems actually did.
How to check or apply this
- Confirm applicability against the three tests with counsel, using current figures.
- Build a data map: every system holding personal information, its owner, retention and recipients.
- Create a single request workflow with an identity check, a deadline tracker and a log.
- Automate the lookup and deletion in each system, and test with a synthetic person.
- Inventory third-party scripts and SDKs, and gate new ones through review.
- Define retention and enforce deletion on schedule.
- Record how opt-out signals are honored, and test them quarterly.
Safeguard's compliance automation can track related tasks and evidence, and dependency scanning helps you see which third-party libraries your products include. It does not decide whether the CCPA applies to you.
Quick check
Does the CCPA only cover California companies?
No. It covers businesses that do business in California and meet the thresholds, wherever they are based.
Is deleting from the main database enough?
Usually not. The data may sit in analytics, support tools, backups and processors, all of which need a plan.
Sources
Last reviewed: 18 October 2026.
