California Consumer Privacy Act, as amended by the California Privacy Rights Act

California's three independent triggers: $25M+ global gross revenue, OR buys/sells/shares personal info of 100,000+ consumers/households, OR derives 50%+ of revenue from selling/sharing personal info. Since 2023, employee and B2B contact data are covered like any other consumer data. New CPPA regulations on automated decision-making, risk assessments, and cybersecurity audits took effect Jan 1, 2026. Only applies to for-profit "businesses" — nonprofits and government are structurally outside its scope.