CCPA/CPRA — California Consumer Privacy and Data Subject Rights (2026)

constraint.ccpa-data-subject-rights-2026 ↗

The California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) grants California residents six data subject rights: Right to Know, Right to Delete, Right to Opt-Out of Sale or Sharing, Right to Correct, Right to Limit Use of Sensitive Personal Information, and Right to Non-Discrimination. Regulations effective January 1, 2026 added Automated Decision-Making Technology (ADMT) rules: businesses using ADMT for significant decisions must provide pre-use notices, honor opt-out rights, and respond to access requests describing the logic and likely outcomes of automated processes. Risk assessment and cybersecurity audit requirements also took effect January 1, 2026. Enforced by the California Privacy Protection Agency (CPPA) — the first dedicated data privacy enforcement agency in the US.