For your ease of reference, we reproduce here a formatted, hyperlinked copy of the California Consumer Privacy Act of 2018 (CCPA), current as of October 15, 2018. We've included our own topic headings in parenthesis for convenience – these are not included in the official text of the CCPA. If you have questions about the CCPA, see our FAQs or contact a member Cooley's cyber/data/privacy team.


1798.100 (Right to Access; Portability)

1798.105 (Right to Deletion)

1798.110 (Right to Information About Collection and Disclosure of Personal Information)

1798.115 (Right to Information About Sales of Personal Information)

1798.120 (Right to Opt-Out of Sale of Personal Information; Selling Minors' Personal Information)

1798.125 (Right to Nondiscrimination)

1798.130 (Transparency Obligations; Process for Exercise of Individual Rights)

1798.135 (Privacy Notice Presentation Requirements; Training; Honoring Opt-Outs)

1798.140 (Definitions)

1798.145 (Exemptions)

1798.150 (Private Right of Action)

1798.155 (Civil Penalties)

1798.160 (Fund Creation)

1798.175 (Harmonization)

1798.180 (Preemption)

1798.185 (Attorney General Regulations)

1798.190 (Non-Circumvention)

1798.192 (Consumer Waivers Void)

1798.194 (Interpretation)

1798.196 (Conflict of Laws)

1798.198 (Operative Date)

1798.199 (Operative Sections)

1798.100 (Right to Access; Portability)

  1. A consumer shall have the right to request that a business that collects a consumer's personal information disclose to that consumer the categories and specific pieces of personal information the business has collected.
  2. A business that collects a consumer's personal information shall, at or before the point of collection, inform consumers as to the categories of personal information to be collected and the purposes for which the categories of personal information shall be used. A business shall not collect additional categories of personal information or use personal information collected for additional purposes without providing the consumer with notice consistent with this section.
  3. A business shall provide the information specified in subdivision (a) to a consumer only upon receipt of a verifiable consumer request.
  4. A business that receives a verifiable consumer request from a consumer to access personal information shall promptly take steps to disclose and deliver, free of charge to the consumer, the personal information required by this section. The information may be delivered by mail or electronically, and if provided electronically, the information shall be in a portable and, to the extent technically feasible, in a readily useable format that allows the consumer to transmit this information to another entity without hindrance. A business may provide personal information to a consumer at any time, but shall not be required to provide personal information to a consumer more than twice in a 12-month period.
  5. This section shall not require a business to retain any personal information collected for a single, one-time transaction, if such information is not sold or retained by the business or to reidentify or otherwise link information that is not maintained in a manner that would be considered personal information.

Download in full >> California Consumer Privacy Act of 2018 – Full Text

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.