CCPA/CPRA · Kalifornien
CCPA §1798.100 Agent
General Duties of Businesses that Collect Personal Information. Gäller företag som gör affärer i Kalifornien och samlar in personuppgifter om invånare där.
Vad måste företaget göra?
§1798.100(a)(1) Notice at collection: categories, purposes, sale or sharing
The categories of personal information to be collected and the purposes for which the categories of personal information are collected or used and whether that information is sold or shared. A business shall not collect additional categories of personal information or use personal information collected for additional purposes that are incompatible with the disclosed purpose for which the personal information was collected without providing the consumer with notice consistent with this section.
§1798.100(a)(2) Notice at collection: sensitive personal information
If the business collects sensitive personal information, the categories of sensitive personal information to be collected and the purposes for which the categories of sensitive personal information are collected or used, and whether that information is sold or shared.
§1798.100(a)(3) Retention period per category
The length of time the business intends to retain each category of personal information, including sensitive personal information, or if that is not possible, the criteria used to determine that period provided that a business shall not retain a consumer's personal information or sensitive personal information for each disclosed purpose for which the personal information was collected for longer than is reasonably necessary for that disclosed purpose.
§1798.100(b) Third parties controlling collection
A business that, acting as a third party, controls the collection of personal information about a consumer may satisfy its obligation under subdivision (a) by providing the required information prominently and conspicuously on the homepage of its internet website.
§1798.100(c) Data minimisation and purpose limitation
A business' collection, use, retention, and sharing of a consumer's personal information shall be reasonably necessary and proportionate to achieve the purposes for which the personal information was collected or processed, or for another disclosed purpose that is compatible with the context in which the personal information was collected, and not further processed in a manner that is incompatible with those purposes.
§1798.100(d) Contracts with third parties, service providers and contractors
A business that collects a consumer's personal information and that sells that personal information to, or shares it with, a third party or that discloses it to a service provider or contractor for a business purpose shall enter into an agreement with the third party, service provider, or contractor, that: (1) specifies limited and specified purposes; (2) obligates compliance and the same level of privacy protection; (3) grants rights to take reasonable steps to ensure consistent use; (4) requires notice if obligations can no longer be met; (5) grants the right to stop and remediate unauthorized use.
§1798.100(e) Reasonable security procedures
A business that collects a consumer's personal information shall implement reasonable security procedures and practices appropriate to the nature of the personal information to protect the personal information from unauthorized or illegal access, destruction, use, modification, or disclosure in accordance with Section 1798.81.5.
Sanktion
§1798.155(a): högst USD 2,500 per överträdelse, USD 7,500 vid uppsåt eller när det gäller konsumenter under 16 år. Beloppen indexjusteras enligt §1798.199.95(d).
Tillsynsfall med officiell källa (3)
- Sephora USA, Inc., California Attorney General, 2022-08-24: USD 1,200,000
- Healthline Media LLC, California Attorney General, 2025-07-01: USD 1,550,000
- Tractor Supply Company, California Privacy Protection Agency, 2025-09-30: USD 1,350,000
- Agent:
- agent:us:ccpa:agent-sec-1798-100
- Källa:
- Cal. Civ. Code §1798.100, läst 2026-10-10
Krav på att radera hela AI-modeller (algorithmic disgorgement) kommer från amerikanska FTC-ärenden, inte från CCPA. Kopplingar mellan fall, krav och kontroller finns i NovaCopilot med partnernyckel. Source: NovaCopilot.