Updated: September 3, 2026 · Docs · Clothoff AI Editorial Team
What is the CCPA?
A glossary entry on California’s consumer privacy law, the rights it gives residents, and how this publisher handles requests.
Educational glossary entry by a review publisher; not legal advice.
Which rights does the CCPA grant?
The CCPA is the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act approved by voters in November 2020. It gives California residents rights to know, delete and correct personal information held by a business, to opt out of its sale or sharing, and to limit use of sensitive data.
The CPRA added the rights to correct and limit sensitive data from January 1, 2023 and created an enforcement agency.
| Law | Effective date | What it covers | Penalty | Source |
|---|---|---|---|---|
| CCPA – right to know and delete | January 1, 2020 | Consumers may request the personal information collected and ask for deletion | Administrative fines per violation | California Attorney General – CCPA |
| CCPA – right to opt out of sale or sharing | January 1, 2020 | “Do Not Sell or Share” requests, including Global Privacy Control signals | Same enforcement | California Attorney General – CCPA |
| CPRA amendments – correct and limit | January 1, 2023 | Right to correct inaccurate data; right to limit use of sensitive data | Enforced by the California Privacy Protection Agency | CPPA regulations |
| Applicability thresholds | January 1, 2023 (updated) | Over $25 million revenue, or data on 100,000 or more consumers or households, or half of revenue from selling or sharing data | Businesses below all thresholds are outside the Act | CCPA statute text, effective January 1, 2026 |
What can a California resident ask a business to do?
A resident may ask what personal information a business has collected, why, and with whom it was shared; request deletion or correction; and direct the business not to sell or share the data. A business must respond within 45 days and may not discriminate against anyone who exercises a right.
Sensitive personal information, such as precise location, credentials, health data and sexual orientation, carries a right to limit its use. Data about consumers under 16 may not be sold without opt-in consent.
Which businesses must comply?
The Act applies to for-profit businesses in California that meet one threshold: gross revenue above $25 million, personal information of 100,000 or more consumers or households, or half or more of revenue from selling or sharing data. Non-profits and small publishers usually fall outside.
Enforcement is shared. The Attorney General brings civil actions, and the California Privacy Protection Agency, created by the CPRA, adopts regulations and issues administrative fines.
How does this site handle California requests?
Clothoff AI does not sell personal information and runs no advertising, but it honors the CCPA framework regardless of thresholds. The Do Not Sell or Share page explains how Global Privacy Control signals are respected, and the data request form handles the other rights.
The privacy policy lists the data the site processes, chiefly server logs and consent choices. Reviewed tools, which run accounts and store uploads, are scored on the same rights under the privacy weight in How we rate.
“The California Consumer Privacy Act of 2018 (CCPA) gives consumers more control over the personal information that businesses collect about them and the CCPA regulations provide guidance on how to implement the law.”
— California Office of the Attorney General – CCPA page (updated August 28, 2026), accessed September 3, 2026
Consent Note
This site is a publisher: it reviews third-party tools and does not create, edit, accept or store images. Docs entries are general information, not legal advice.
Sources
All sources accessed on September 3, 2026; educational entry, not legal advice.
- California Office of the Attorney General – California Consumer Privacy Act (CCPA)
- California Privacy Protection Agency – Regulations
- CCPA statute text as amended, effective January 1, 2026 (CPPA PDF)
- California Civil Code §1798.100 et seq. – California Legislative Information
- FTC – Children’s Privacy (COPPA, for comparison)
FAQ: CCPA
Does the CCPA apply to a small review website?
Usually not by threshold: a publisher under $25 million in revenue that holds data on fewer than 100,000 consumers and sells none of it falls outside the Act. This site nonetheless honors opt-out signals and data requests as policy, because the subject matter is sensitive.
What is “Do Not Sell or Share”?
A link and process every covered business must offer so residents can stop the sale of their personal information or its sharing for cross-context behavioral advertising. Businesses must also treat browser-level Global Privacy Control signals as a valid opt-out request.
What is the difference between the CCPA and the CPRA?
The CCPA is the 2018 statute. The CPRA, approved by voters in November 2020, amended it from January 1, 2023 by adding the rights to correct and limit sensitive data, creating the California Privacy Protection Agency and raising the consumer threshold to 100,000.
How long does a business have to respond?
Requests to know, delete or correct must be answered within 45 days, extendable once with notice. Opt-out requests must be honored within 15 business days. The business must verify identity before disclosing or deleting data, but not before processing an opt-out.
Are photos uploaded to an undress app personal information?
Yes. An image of an identifiable person is personal information, and a face or body image may be sensitive personal information as biometric data. Covered tools must disclose retention, honor deletion requests and stop sharing on request, which is why reviews record the deletion route.
Do other states have similar laws?
Yes. More than a dozen states have enacted comprehensive privacy laws modeled on the CCPA, with rights to access, delete and opt out of targeted advertising. Details differ, so this site applies the California standard to every visitor as the strictest common baseline.