CCPA Compliance Checklist: 10 Steps for SaaS in 2026

Q: What actions are required for CCPA compliance?

At minimum: map the personal information you collect, publish a notice at collection and a CCPA-compliant privacy policy, offer consumers the rights to know, delete, correct, and opt out of the sale or sharing of their data, honor Global Privacy Control signals automatically, limit the use of sensitive personal information on request, verify and respond to consumer requests within 45 days, put CCPA-required contract terms in place with every service provider and contractor, maintain reasonable security, and train the staff who handle requests. Everything else is refinement on those ten.

Q: Who has to comply with the CCPA?

For-profit businesses that do business in California and meet one of three thresholds: more than $25 million in gross annual revenue in the preceding calendar year; buying, selling, or sharing the personal information of 100,000 or more California consumers or households per year; or deriving 50% or more of annual revenue from selling or sharing personal information. You do not need an office, employees, or servers in California. A B2B SaaS company in Berlin with California customers can be in scope. Non-profits and government agencies are generally out of scope.

Q: How long do I have to respond to a CCPA consumer request?

You must confirm receipt within 10 business days and substantively respond within 45 calendar days of receiving the request. You can extend once by another 45 days (90 total) if you notify the consumer of the extension and the reason within the original window. Opt-out requests are different and stricter: you must act on them as soon as feasibly possible and no later than 15 business days, and you must notify third parties you sold or shared the data with in the prior 90 days.

Q: Is a free CCPA compliance checklist enough to get compliant?

A free checklist is useful for scoping and for making sure you have not forgotten a category of work. It is not enough on its own, because the hard parts of CCPA compliance are specific to your data flows: whether your ad tech constitutes 'sharing,' whether a vendor is a service provider or a third party, and whether your request-verification process is proportionate to the sensitivity of the data. Those determinations require looking at your actual systems and contracts, not ticking boxes.

Q: Does CCPA compliance make me GDPR compliant?

No. The two laws overlap on data mapping, security, vendor contracts, and consumer rights infrastructure, which is why teams often build one program with two lenses. But GDPR requires a documented lawful basis before processing, a Record of Processing Activities, transfer mechanisms for data leaving the EU, and in some cases a Data Protection Officer. The CCPA has no equivalent for any of those. GDPR compliance gets you most of the way to CCPA. The reverse is not true.

Q: What are the penalties for failing a CCPA compliance check?

Administrative fines run up to $2,500 per violation and up to $7,500 per intentional violation or per violation involving the personal information of a consumer under 16. Violations are counted per consumer, so a single misconfigured opt-out across a large user base compounds quickly. Separately, consumers have a private right of action for breaches of unencrypted, unredacted personal information caused by unreasonable security, at $100 to $750 per consumer per incident, or actual damages if higher.

Most teams looking for a CCPA compliance checklist do not need a 60-page legal memo. They need to know which ten things actually have to be true, in what order, and which of them their engineering team owns versus their lawyer.

This is that list, written for a SaaS company that collects personal information from California residents and wants a defensible program rather than a privacy policy with the right words in it.

First: Does the CCPA Even Apply to You?

The California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), covers for-profit businesses that do business in California and meet at least one of three thresholds:

More than $25 million in gross annual revenue in the preceding calendar year
Buying, selling, or sharing the personal information of 100,000 or more California consumers or households annually
Deriving 50% or more of annual revenue from selling or sharing personal information

Three things surprise people here.

You do not need a California presence. No office, no employees, no servers. If you collect personal information from California residents in the course of doing business there, you can be in scope from anywhere.

The revenue threshold is company-wide, not California-specific. A $30 million ARR company with 40 California customers meets the first threshold on revenue alone.

"Personal information" is broader than you think. It covers IP addresses, device identifiers, cookie IDs, inferences drawn from behavior, and geolocation — not just names and emails. If you run analytics or advertising pixels, you are collecting personal information.

Employee and B2B contact data are also in scope. The temporary exemptions that once carved them out expired on January 1, 2023. Your HR records and your sales prospect database are covered.

The CCPA Compliance Checklist

1. Map your data

Everything else on this checklist depends on this step, and it is the one teams most often skip.

Document, per system: what personal information you collect, the categories it falls into, the business purpose for collecting it, how long you keep it, who you disclose it to, and whether that disclosure is a sale or a share.

You cannot answer a deletion request accurately if you do not know that a copy of the record lives in your data warehouse, your support tool, and last month's CSV export sitting in someone's Drive folder.

2. Classify sensitive personal information separately

The CPRA created a distinct category of sensitive personal information: government IDs, financial account credentials, precise geolocation, race or ethnicity, religious beliefs, union membership, contents of private communications, genetic and biometric data, and health or sex-life data.

Tag it separately in your inventory. It triggers its own consumer right (step 6) and its own notice obligations.

3. Publish a compliant privacy policy

Your privacy policy must describe the categories of personal information collected, the sources, the business or commercial purposes, the categories disclosed or sold or shared, the categories of recipients, your retention periods, and how consumers exercise each right.

It must be updated at least every 12 months, and the update date must be visible on the page. An undated policy is one of the cheapest violations to spot from the outside.

4. Serve a notice at collection

This is a separate obligation from the privacy policy, and it is commonly missed.

At or before the point you collect personal information, tell the consumer what categories you are collecting, why, how long you will keep it, and whether it will be sold or shared. In practice that means notice text on the signup form, the lead-capture form, and the cookie banner — not just a link buried in the footer.

5. Build the opt-out path — including GPC

If you sell or share personal information (and using most third-party advertising or analytics pixels counts as "sharing" for cross-context behavioral advertising), you must provide a clear "Do Not Sell or Share My Personal Information" link on your homepage.

You must also honor the Global Privacy Control (GPC) — a browser-level opt-out signal — automatically, as a valid request, without making the consumer click anything. This is the single most common technical gap we find. A site can have a perfect opt-out link and still fail because the GPC header hits the server and nothing downstream reads it.

Test it: send a request with the Sec-GPC: 1 header and confirm your tag manager actually suppresses the pixels.

6. Honor the right to limit sensitive personal information

If you use sensitive personal information for anything beyond the narrow set of permitted business purposes (providing the service, security, quality assurance), you must offer a "Limit the Use of My Sensitive Personal Information" link.

Many SaaS companies do not trigger this, because they only use sensitive data to deliver the product. Document that determination rather than assuming it. The assumption is the risk, not the answer.

7. Stand up request intake, verification, and response

You need at least two methods for consumers to submit requests (a toll-free number is required for businesses that operate offline; an online form plus email is typical for pure web businesses).

Then build the workflow:

Confirm receipt within 10 business days
Respond substantively within 45 calendar days, extendable once to 90 with notice
Act on opt-outs as soon as feasibly possible, and no later than 15 business days
Verify identity proportionate to the sensitivity of the data — more rigor for a deletion request touching financial data than for a categories-only disclosure
Keep records of requests and responses for 24 months

The rights you must support are: know/access, delete, correct, opt out of sale or sharing, limit sensitive personal information use, portability, and non-retaliation for exercising any of them.

8. Fix your vendor contracts

This is where most programs are quietly non-compliant.

Every vendor that touches California personal information needs contract terms that specify the limited purpose, prohibit selling the data, prohibit retaining or using it outside the direct business relationship, and require them to notify you if they can no longer meet their obligations.

The classification matters enormously:

A service provider or contractor processes data on your documented instructions. Disclosure to them is not a sale.
A third party uses the data for its own purposes. Disclosure to them likely is a sale or share, which triggers the opt-out obligations in step 5.

An ad tech vendor you assumed was a service provider, but whose contract lets them use the data to improve their own models, is a third party. That reclassification can move your entire company into "we sell data" territory.

9. Maintain reasonable security

The CCPA does not enumerate controls, but it creates a private right of action for breaches of unencrypted, unredacted personal information caused by a failure to maintain "reasonable" security. Plaintiffs' lawyers set the definition in practice.

Encryption in transit and at rest, role-based access control, MFA, logging, and a tested incident response plan are the floor. If you already run SOC 2 or ISO 27001, you have this covered and should say so in your security documentation.

10. Train the people, then document everything

Anyone handling consumer inquiries needs training on how to recognize and route a CCPA request. Someone emailing "delete my account" to support is a deletion request, whether or not they cite the statute.

Then keep the paper: your data map, your classification decisions, your vendor contract terms, your request log, your GPC test results, and your training records. Enforcement is a documentation exercise. If you cannot show your work, you did not do it.

Newer Obligations: Risk Assessments, Cyber Audits, and ADMT

The California Privacy Protection Agency (CPPA) has adopted regulations extending beyond the original ten steps, covering cybersecurity audits, risk assessments for high-risk processing, and automated decision-making technology (ADMT) — including notice and opt-out rights where automated systems make significant decisions about consumers.

These phase in on a staggered schedule tied to company size and revenue, and the dates have moved during rulemaking. Treat them as real and near-term rather than theoretical, and confirm the current deadlines directly with the CPPA before you build a plan around a specific date. If you use automated scoring, screening, or profiling in a way that affects a consumer's access to a service, start scoping now.

Free CCPA Compliance Checklist Templates: What They Miss

There is no shortage of a free CCPA compliance checklist online, and they are genuinely useful for scoping. Use one to make sure you have not missed a whole category of work.

What they cannot do is make the three judgment calls that determine whether you are actually compliant:

Is this disclosure a sale or a share? Depends on your contract and the vendor's actual use, not on the checkbox in their trust center.
Is this vendor a service provider or a third party? Same problem. Read the data-use clause, not the marketing page.
Is our verification process proportionate? Too weak and you leak data to an impostor. Too strong and you have created an unlawful barrier to a statutory right.

A template gives you the questions. Your data flows give you the answers.

CCPA Compliance Checklist for California vs Multi-State

Teams often start with a CCPA compliance checklist for California and then discover that a dozen other states have passed comprehensive privacy laws with similar-but-not-identical requirements.

The efficient pattern is to build for the strictest requirement and apply it everywhere:

Universal opt-out honoring (GPC) satisfies California and most other state signals
A single request-intake workflow with the shortest response clock covers all of them
One set of vendor contract terms drafted to the strictest standard avoids renegotiating per state

Segmenting rights by user state is technically permitted and operationally miserable. Most SaaS teams that try it end up applying the strictest standard universally within a year anyway.

If you are already doing GDPR compliance work, roughly 60% of a CCPA compliance checklist is already built: the data map, the security controls, the vendor diligence, the request workflow, and the retention schedule all transfer.

What does not transfer:

GDPR requires a lawful basis before processing. The CCPA has no equivalent — it regulates disclosure and consumer rights, not the initial permission to process.
The CCPA's opt-out model is the inverse of GDPR's opt-in consent model for advertising. You cannot reuse your EU consent banner logic for California without changes.
"Sale" and "share" have no GDPR analogue. This is CCPA-specific classification work.

Build the shared foundation once, then layer the framework-specific pieces on top. That approach is covered in more depth in our post on GDPR and CCPA compliance.

What Enforcement Actually Looks Like

Enforcement comes from two directions: the California Attorney General and the CPPA's own enforcement division.

Administrative penalties run to $2,500 per violation and $7,500 per intentional violation or one involving a consumer under 16. Because violations are counted per consumer, a single broken opt-out across a large user base is not one violation.

The CPRA also removed the automatic 30-day right to cure. A regulator may consider whether you fixed the issue, but you are no longer entitled to a grace period.

Early enforcement has concentrated on the visible, testable things: missing "Do Not Sell or Share" links, ignored GPC signals, privacy policies that omit required disclosures, and request workflows that quietly never respond. All four are checkable from outside your company in about ten minutes, which is exactly why they get checked first.

For the underlying statutory requirements, see our breakdown of CCPA requirements and the CCPA service page. If you also operate in the EU, GDPR and CCPA compliance covers running both programs from one foundation, and the GDPR service page outlines that scope of work.

Frequently Asked Questions

What actions are required for CCPA compliance? Map your data, publish a notice at collection and a compliant privacy policy, support the rights to know, delete, correct, and opt out, honor GPC signals automatically, offer the sensitive-information limit where it applies, respond to requests within 45 days, put CCPA terms in every vendor contract, maintain reasonable security, and train your team. Everything else refines those ten.

Who has to comply with the CCPA? For-profit businesses doing business in California that exceed $25 million in gross annual revenue, handle the personal information of 100,000+ California consumers or households, or earn 50%+ of revenue from selling or sharing personal information. No California office or servers required.

How long do I have to respond to a CCPA consumer request? Confirm receipt within 10 business days and respond within 45 calendar days, extendable once to 90 with notice. Opt-out requests must be honored as soon as feasibly possible and within 15 business days.

Is a free CCPA compliance checklist enough to get compliant? It is enough to scope the work, not to finish it. The determinations that decide compliance — sale versus share, service provider versus third party, proportionate verification — depend on your actual data flows and contracts.

Does CCPA compliance make me GDPR compliant? No. GDPR additionally requires a documented lawful basis, a Record of Processing Activities, international transfer mechanisms, and sometimes a DPO. GDPR work covers most of CCPA; CCPA work does not cover GDPR.

What are the penalties for failing a CCPA compliance check? Up to $2,500 per violation, $7,500 per intentional violation or one involving a minor, counted per consumer. Data breaches caused by unreasonable security carry a private right of action at $100–$750 per consumer per incident.

Ready to Work Through Your CCPA Compliance Checklist?

ShieldKey Solutions runs CCPA readiness assessments for SaaS companies: we map your data flows, classify every vendor relationship, test your opt-out and GPC handling end to end, and hand you a prioritized remediation plan with owners and dates. If you also need GDPR, we build both from one foundation.

Schedule a scoping call →