19 states now have comprehensive privacy laws in effect, enforcement fines reached an estimated $1.4 billion in 2025, and the CPPA has hundreds of open investigations. If your organization collects data from California residents, the rules have never been clearer or the stakes higher.
Sources: California Privacy Protection Agency (CPPA), Smith Law analysis of state enforcement data
This guide breaks down the updated CCPA/CPRA requirements, the new regulations finalized in 2025 for cybersecurity audits and risk assessments, and what your compliance program must cover to hold up under scrutiny. Download the checklist to get a step-by-step action plan.
Download the Free CCPA Compliance ChecklistNo credit card required. Just your email and company name.
Swiss-Hosted
ISO 27001 Infrastructure
GDPR & CCPA Ready
SOC 2 Aligned
Trusted by privacy teams at organizations managing compliance across 50+ jurisdictions.
You've read the law. You've skimmed a few blog posts. And you're still not sure whether your organization is actually compliant, or just hoping it is. Here's what makes CCPA compliance so difficult at scale.
CCPA was amended by CPRA in 2020, creating the California Privacy Protection Agency with independent enforcement power. Requirements are a moving target. In September 2025, the CPPA finalized new regulations covering cybersecurity audits, risk assessments, and automated decision-making technology, with compliance deadlines stretching into 2028.
New CCPA regulations approved by OAL, September 23, 2025, effective January 1, 2026
For organizations with multiple subsidiaries or business units, determining which entities meet CCPA thresholds is operationally brutal. Each entity must be assessed independently against the CPI-adjusted thresholds: $26.625M+ annual gross revenue, 100,000+ consumers or households, or 50%+ revenue from selling or sharing personal information.
Thresholds updated January 1, 2025, per CPPA CPI adjustment
Many teams start with Excel-based data inventories and manual DSR tracking. This works until it doesn't: usually right around the time a consumer complaint arrives or the CPPA sends an inquiry. The agency's investigation of Tractor Supply began with a single consumer complaint, ultimately resulting in a record $1.35M fine.
CPPA v. Tractor Supply Company, September 30, 2025
As of 2025, fines reach up to $2,663 per unintentional violation and $7,988 per intentional violation, adjusted for inflation. Penalties are assessed per affected consumer, meaning a single compliance gap touching thousands of people can escalate into millions. The CPPA reported hundreds of investigations in progress during 2025.
CPI-adjusted penalty amounts effective January 1, 2025; CPPA announcement December 17, 2024
The CPPA's 30-day cure period was removed under CPRA. Recent enforcement includes the $1.35M Tractor Supply settlement, $632,500 against Honda, and $345,178 against Todd Snyder. The agency has also launched a Data Broker Enforcement Strike Force and the Attorney General conducted a geolocation data sweep in March 2025.
Enforcement actions reported by CPPA, 2025; AG investigative sweep, March 10, 2025
Most organizations subject to CCPA also manage GDPR, the Swiss FADP, and a growing patchwork of U.S. state privacy laws in Virginia, Colorado, Connecticut, Texas, Oregon, and more. Siloed compliance programs create gaps, duplicated effort, and inconsistent consumer experiences that regulators will notice.
20+ U.S. states have enacted comprehensive privacy laws as of 2025
Sound familiar? You're not alone. The good news: a structured compliance program makes all of this manageable.
Download the Free CCPA Compliance ChecklistOneTrust dominates the Fortune 500. But if you manage privacy across multiple subsidiaries without a 20-person compliance department, you need a platform built for how you actually work.
Priverion
All data processing happens within Swiss infrastructure. Switzerland holds an EU adequacy decision, meaning your compliance data never leaves a jurisdiction the EU has vetted and approved. In a post-Schrems II world, that is not a nice-to-have; it is a legal safeguard.
Pricing is based on the number of companies and organizational size. Not per-user, not per-module. You will never get a surprise invoice because you added a new subsidiary or onboarded another business unit.
Aircraft manufacturer reduced compliance admin time by 60% in their first six months. Medtec saved 200+ hours preparing for ISO 27001. You do not need a dedicated implementation team or a six-figure services engagement to go live.
Aircraft manufacturer, first 6 months; Medtec, ISO 27001 prep
Purpose-built for organizations managing compliance across multiple entities and jurisdictions. Cross-entity data mapping, automated ROPA recertification, and a single DPO dashboard that shows the full picture.
AI helps draft DPIAs, score risks, and map regulatory requirements. Every output is reviewed before it becomes a compliance record. No customer data is used for model training. Transparency and control, always.
Typical enterprise platform
The EU-US Data Privacy Framework is in place, but legal uncertainty remains. A French MEP challenged it in 2025, and privacy advocates have signaled a potential "Schrems III" challenge. For compliance data specifically, hosting in a jurisdiction with a stable EU adequacy track record reduces your regulatory exposure.
DLA Piper GDPR Fines and Data Breach Survey, January 2026
Major enterprise platforms bill each module on its own metric. Your consent plan scales by daily visitors; your privacy automation plan scales by admin users and asset inventory. Costs can climb in directions you did not anticipate. Implementation services are typically billed separately on top of licensing.
Vendr marketplace data, February 2026; G2 and Capterra user reviews
Reviewers consistently cite steep learning curves and complex configuration requirements. Mid-market teams without dedicated implementation resources often spend weeks setting up workflows and mapping data before the platform delivers results.
G2 reviews, mid-market segment, 2025
Enterprise platforms excel at deep regulatory coverage across 300+ jurisdictions. But multi-subsidiary organizations often find that coordinating compliance across a group of entities requires workflows these platforms were not originally designed around.
Comprehensive platforms cover ESG, ethics hotlines, cookie consent, and more. That breadth is valuable if you need it all, but mid-market teams often end up paying for capabilities they will never use while navigating a cluttered interface.
Capterra and G2 user reviews, 2025
Cumulative GDPR fines now exceed €7.1 billion, with €1.2 billion issued in 2025 alone. European data protection authorities receive 443 breach notifications per day, a 22% year-over-year increase. Enforcement is expanding beyond Big Tech into finance, healthcare, telecommunications, and the public sector.
Priverion is not trying to be everything to everyone. We do not cover ESG reporting, ethics hotlines, or cookie consent management. We are not built for single-entity companies. Our integrations go deep with the systems that matter for privacy workflows (HR, procurement, IT asset management) rather than offering 200 shallow connectors.
If you need a platform that does all of the above, an enterprise suite may be the right fit. If you need a platform that makes multi-entity privacy program management simple, automated, and affordable, that is exactly what we built.
30-minute walkthrough, no commitment required
New CCPA regulations took effect January 1, 2026, introducing mandatory risk assessments, cybersecurity audit requirements, and expanded opt-out obligations. With fines reaching up to $7,988 per intentional violation and no cap on total penalties, multi-entity organizations face compounding exposure across every subsidiary. This guide breaks it all down into a clear, actionable plan.
Inside the guide, you will find:
$7,988 per intentional violation, no total cap on penalties
CPPA fine schedule effective January 2025, remaining in effect through 2026. Source: California Privacy Protection Agency.
Get the complete CCPA compliance guide, updated for the 2026 regulatory changes, delivered straight to your inbox.
Free PDF. No demo required. We'll send it to your inbox.
Why this matters right now
Only 11% of companies currently meet all CCPA requirements. The California AG issued the largest CCPA settlement to date in February 2026: a $2.75 million penalty against Disney for opt-out failures across streaming services.
Sources: CYTRIO State of CCPA Compliance report; IAPP, February 2026.
The compliance landscape is not slowing down
Regulators issued over 2,800 GDPR fines through mid-2025, with enforcement expanding well beyond Big Tech into healthcare, finance, and the public sector. European data protection authorities now receive 443 breach notifications per day. If you are managing compliance across multiple entities and jurisdictions, manual processes are no longer a calculated risk. They are a ticking clock.
60%
reduction in compliance admin time
(Aircraft manufacturer, first 6 months)
200+
hours saved on ISO 27001 prep
(Medtec)
100%
automated ROPA recertification
(AXA)
Swiss-built. Swiss-hosted. AI-assisted with full human oversight. Predictable pricing with no per-user traps. Book a 30-minute walkthrough and see how Priverion gives DPOs their strategic time back.
Book Your 30-Minute WalkthroughNo commitment required. See the platform live with your use case in mind.
Enforcement data: DLA Piper GDPR Fines and Data Breach Survey, January 2026
The California Consumer Privacy Act, as amended by CPRA, now imposes CPI-adjusted penalties of up to $7,988 per intentional violation and requires cybersecurity audits under regulations finalized in September 2025. With 19 U.S. states enforcing comprehensive privacy laws and the CPPA conducting hundreds of active investigations, multi-entity organizations need structured compliance programs that scale across jurisdictions. Priverion's Swiss-hosted platform provides automated ROPA recertification, cross-entity data mapping, and a single DPO dashboard to manage CCPA, GDPR, and Swiss FADP obligations from one system.
The California Consumer Privacy Act (CCPA) is a state-level privacy law enacted in 2018 (Cal. Civ. Code §§ 1798.100–1798.199.100) that grants California residents rights over their personal information, including the right to know, delete, and opt out of the sale or sharing of their data. It was significantly amended by the California Privacy Rights Act (CPRA) in 2020. IAPP U.S. State Privacy Legislation Tracker
The California Privacy Protection Agency (CPPA) is the independent state agency created by CPRA to implement and enforce the CCPA. It has rulemaking authority and can investigate violations, impose administrative fines, and bring enforcement actions without relying on the Attorney General. IAPP Privacy Tracker
A Record of Processing Activities (ROPA) is a documented inventory of all personal data processing operations within an organization. Under GDPR Article 30, controllers and processors must maintain ROPAs. While CCPA does not explicitly mandate ROPAs, maintaining one is considered best practice for demonstrating compliance with data inventory and consumer-rights obligations. GDPR Article 30 — gdpr-info.eu
A Data Protection Impact Assessment (DPIA) is a systematic process for evaluating the potential impact of data processing on individuals' privacy. Under the new CPPA regulations finalized in September 2025, organizations must conduct risk assessments for processing that presents significant risk to consumers' privacy, with compliance deadlines extending to 2028.
The California Consumer Privacy Act (CCPA) was enacted in 2018 and took effect January 1, 2020. The California Privacy Rights Act (CPRA) amended the CCPA in 2020, creating the California Privacy Protection Agency (CPPA) with independent enforcement power. CPRA introduced new consumer rights around sensitive personal information and automated decision-making technology, expanded opt-out rights to cover "sharing" of data (not just "selling"), and eliminated the 30-day cure period that previously allowed businesses to fix violations before facing penalties. IAPP U.S. State Privacy Legislation Tracker
As of January 1, 2025, CCPA applies to for-profit entities doing business in California that meet any of these CPI-adjusted thresholds: $26.625 million or more in annual gross revenue, buying/selling/sharing personal information of 100,000 or more consumers or households, or deriving 50% or more of annual revenue from selling or sharing personal information. These thresholds are adjusted annually for inflation by the CPPA.
As of 2025, CPI-adjusted penalties reach up to $2,663 per unintentional violation and $7,988 per intentional violation. Penalties are assessed per affected consumer, meaning a single compliance gap touching thousands of individuals can escalate into millions of dollars. The CPPA's record fine of $1.35 million against Tractor Supply Company in September 2025 demonstrates the agency's willingness to impose significant penalties.
As of January 2026, 19 U.S. states have comprehensive privacy laws in effect, including California, Virginia, Colorado, Connecticut, Utah, Iowa, Indiana, Tennessee, Texas, Montana, Oregon, Delaware, New Hampshire, New Jersey, Nebraska, Kentucky, Maryland, Minnesota, and Rhode Island. Additional states have enacted laws with future effective dates. According to the IAPP U.S. State Privacy Legislation Tracker, this number continues to grow each legislative session.
In September 2025, the CPPA finalized new regulations covering cybersecurity audits, risk assessments, and automated decision-making technology (ADMT). These were approved by the Office of Administrative Law on September 23, 2025, with an effective date of January 1, 2026. Compliance deadlines for cybersecurity audits extend into 2027–2028, giving organizations time to build the required programs.
Yes. Priverion is purpose-built for organizations managing compliance across multiple subsidiaries and jurisdictions. The platform provides cross-entity data mapping, automated ROPA recertification, AI-assisted DPIA drafting, and a single DPO dashboard. All data is hosted in Swiss infrastructure, which benefits from Switzerland's EU adequacy decision, providing legal safeguards for organizations managing both CCPA and GDPR obligations.
The largest CPPA fine in 2025 was $1.35 million against Tractor Supply Company, announced September 30, 2025. The investigation originated from a single consumer complaint. Other notable 2025 enforcement actions included $632,500 against Honda and $345,178 against Todd Snyder. The CPPA also launched a Data Broker Enforcement Strike Force, and the California Attorney General conducted a geolocation data sweep in March 2025.
Switzerland holds an EU adequacy decision under GDPR (Commission Decision 2000/518/EC), meaning compliance data stored in Swiss infrastructure never leaves a jurisdiction the EU has vetted and approved. In a post-Schrems II environment — where the CJEU invalidated the EU-US Privacy Shield — Swiss hosting provides a legal safeguard for organizations managing both CCPA and GDPR obligations, avoiding the transfer-mechanism complexities of US-hosted platforms.
| Dimension | CCPA / CPRA (California) | GDPR (EU/EEA) | Swiss FADP (revFADP) |
|---|---|---|---|
| Effective date | Jan 1, 2020 (CCPA); Jan 1, 2023 (CPRA amendments) | May 25, 2018 | Sep 1, 2023 |
| Scope | For-profit businesses meeting revenue/data thresholds | Any entity processing EU/EEA residents' data | Any entity processing data of persons in Switzerland |
| Supervisory authority | CPPA + California AG | National DPAs (e.g., CNIL, BfDI, ICO) | FDPIC (Federal Data Protection and Information Commissioner) |
| Max penalty (per violation) | $7,988 (intentional, CPI-adjusted 2025) | €20M or 4% global turnover | CHF 250,000 (individual liability) |
| Right to delete | Yes | Yes (Art. 17) | Yes (Art. 32) |
| Right to opt out of sale/sharing | Yes | N/A (consent-based model) | N/A (consent-based model) |
| Data breach notification | Via California Civil Code § 1798.82 | 72 hours to DPA (Art. 33) | As soon as possible to FDPIC (Art. 24) |
| DPO / Privacy officer required | No statutory requirement | Yes, in certain cases (Art. 37) | Recommended, not mandatory |
| Cross-border transfer mechanism | No specific mechanism | SCCs, BCRs, adequacy decisions | Adequacy list, SCCs, BCRs |
According to the IAPP U.S. State Privacy Legislation Tracker, 19 states had comprehensive privacy laws in effect as of January 2026, with several more enacted and awaiting effective dates. The CPPA reported hundreds of open investigations during its September 2025 board meeting. CPI-adjusted penalty amounts ($2,663 unintentional; $7,988 intentional) became effective January 1, 2025. The NIST Privacy Framework (nist.gov) provides a voluntary tool that organizations can use to identify and manage privacy risk alongside CCPA compliance. The European Data Protection Board's guidelines on international transfers (edpb.europa.eu) remain relevant for organizations managing both GDPR and CCPA obligations across jurisdictions.
