Privacy · California CCPA & CPRA · Chicago

CCPA and CPRA Compliance for Chicago and Illinois Companies

For companies based outside California that have California customers, users or employees. We confirm whether the act reaches you, then build the notices, request procedures, opt-out mechanisms and vendor contracts it requires.

The California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), does not ask where your company is located. It asks whether you do business in California, collect the personal information of California residents, and meet one of three thresholds (Cal. Civ. Code 1798.140(d)). A Chicago company with an online store, a software platform with California users, or an employer with remote staff in that state can meet that test without an office there. That is why the work starts with scope, not with the privacy policy.

Who is a covered business under section 1798.140(d)

The act applies to a for-profit entity that collects consumers’ personal information, determines the purposes and means of processing it, does business in California, and meets at least one of these thresholds:

• Annual gross revenues above $25,000,000 in the preceding calendar year, a figure that is adjusted for inflation. The California Privacy Protection Agency (CPPA) adjusted it to $26,625,000 effective January 1, 2025.
• It annually buys, sells or shares the personal information of 100,000 or more consumers or households.
• It derives 50 percent or more of its annual revenues from selling or sharing consumers’ personal information.

The agency adjusts the monetary figures in odd-numbered years, so the next adjustment is due in 2027. An entity that controls or is controlled by a covered business, shares its branding and receives personal information from it is covered as well. A consumer is a natural person who is a California resident (Cal. Civ. Code 1798.140(i)), and according to the California Attorney General the exemptions for employment-related information and for business-to-business transaction information expired on December 31, 2022. California employees and business contacts count.

Some categories of data fall outside the act. It does not apply to protected health information governed by HIPAA or to medical information governed by California’s medical confidentiality statute, and it exempts information subject to the Gramm-Leach-Bliley Act and the Fair Credit Reporting Act, although those last two exemptions do not reach the data breach action (Cal. Civ. Code 1798.145). The exemption belongs to the data, not to the business. A healthcare practice or management services organization that crosses a threshold remains subject to the act for its website, marketing and workforce data.

Notice at collection and the proportionality limit

At or before the point of collection, a business must tell the consumer the categories of personal information it collects, the purposes for which it uses them, whether it sells or shares them, the same information for sensitive personal information, and how long it intends to keep each category or the criteria for deciding (Cal. Civ. Code 1798.100(a)). A new and incompatible use requires a new notice. Collection, use, retention and disclosure must be reasonably necessary and proportionate to the disclosed purposes (1798.100(c)), and the business must maintain reasonable security (1798.100(e)).

Consumer rights and the 45-day response deadline

A California consumer may ask a business to:

• Delete personal information it collected from the consumer, subject to the statutory exceptions, and tell its service providers, contractors and third parties to do the same (1798.105).
• Correct inaccurate personal information (1798.106).
• Disclose the categories and specific pieces of information it collected, the sources, the purposes and the categories of third parties that received them (1798.110), and what it sold, shared or disclosed and to whom (1798.115).
• Stop selling or sharing the consumer’s personal information (1798.120). For consumers under 16 the rule reverses: the business needs affirmative authorization before it sells or shares.
• Limit its use of sensitive personal information to what is needed to provide the requested goods or services (1798.121).

The business may not deny goods or services, charge a different price, or retaliate against an employee or independent contractor for exercising these rights (1798.125). It must offer at least two methods for submitting requests and respond within 45 days of a verifiable request, with one 45-day extension when reasonably necessary and when the consumer is told within the first period (1798.130).

Selling, sharing and the opt-out preference signal

In this act, sharing has a technical meaning: disclosing personal information to a third party for cross-context behavioral advertising. Many companies that do not sell customer lists do share data in that sense through advertising pixels and tags on their websites. A business that sells or shares must post a clear link on its homepage titled “Do Not Sell or Share My Personal Information” and, if it uses sensitive information for other purposes, a link titled “Limit the Use of My Sensitive Personal Information”, and it must wait at least 12 months before asking a consumer who opted out to authorize the practice again (1798.135). The California Attorney General states that the Global Privacy Control, a signal sent by the browser, must be honored as a valid opt-out request. Since January 1, 2026 the regulations also require a way for the consumer to confirm the status of an opt-out request, including one sent by that signal (Cal. Code Regs. tit. 11, 7025(c)(6), 7026(g)).

Service provider, contractor and third-party contracts

A vendor is a service provider or contractor only if its written contract prohibits it from selling or sharing the personal information, from retaining, using or disclosing it for any purpose other than the business purposes specified in the contract or outside the direct business relationship, and from combining it with information received from other sources, except as the regulations allow. A contractor’s contract must also include a certification that it understands those restrictions and will comply, and both must notify the business when they engage a subcontractor and bind it in writing to the same terms (Cal. Civ. Code 1798.140(j), (ag)).

Separately, every business that sells, shares or discloses personal information to a third party, service provider or contractor must have an agreement that limits use to specified purposes, obligates the recipient to comply with the act and provide the same level of protection, lets the business verify that use, requires the recipient to give notice if it can no longer comply, and lets the business stop and remediate unauthorized use (1798.100(d)).

CPPA regulations: risk assessments, cybersecurity audits and automated decisions

The CPPA announced that the California Office of Administrative Law approved its regulations on cybersecurity audits, risk assessments and automated decisionmaking technology on September 23, 2025, together with updates to the existing regulations, and that they took effect on January 1, 2026 (Cal. Code Regs. tit. 11, 7000 et seq.). The dates the agency gives are these:

• Risk assessments. Compliance began on January 1, 2026. The agency explains that the assessment must be done before starting activities such as selling or sharing personal information or processing sensitive personal information. By April 1, 2028 the business must submit to the CPPA an attestation that the required assessments were completed and a summary of their information.
• Cybersecurity audits. Businesses required to perform them must submit certifications to the CPPA on dates staggered by size: April 1, 2028, April 1, 2029 or April 1, 2030.
• Automated decisions. Businesses that use automated decisionmaking technology to make significant decisions must comply with those requirements beginning January 1, 2027.

If your company uses automated tools in hiring, lending or other decisions about people, these rules intersect with the Illinois laws we explain on our AI governance and privacy page.

Enforcement, fines and the private lawsuit for data breaches

The CPPA may impose administrative fines, and the California Attorney General may seek civil penalties in court. Under the adjustment in effect since January 1, 2025, the maximum in both cases is $2,663 for each violation or $7,988 for each intentional violation (Cal. Civ. Code 1798.155, 1798.199.90). The Attorney General notes that for most violations only that office or the agency may take action.

The exception is a data breach. A consumer may sue when certain categories of personal information, such as a name together with a Social Security number, a financial account number with its access credentials, or medical information, are exposed because the business failed to maintain reasonable security procedures and practices (Cal. Civ. Code 1798.150). Statutory damages currently run from not less than $107 to not more than $799 per consumer per incident, or actual damages if greater. Before seeking statutory damages the consumer must give written notice, and the business has 30 days to cure the violation and confirm it in writing. Documented security measures are therefore the main defense.

How a CCPA and CPRA engagement works

Lincoln Square Law provides CCPA and CPRA compliance counsel to Chicago and Illinois companies. The firm’s founding attorney has served as in-house general counsel and privacy officer for multi-site healthcare organizations and holds the CIPP/US and AIGP certifications. We begin with a written applicability analysis based on your revenue, consumer counts and data flows. If the act reaches you, we prepare the data map, the notice at collection and privacy policy, the request procedure, the links and opt-out signal configuration, the vendor terms and the risk assessments. The program is written to extend to the other states, which we explain on our state data privacy compliance page, and is coordinated with the Illinois obligations described on the Illinois data privacy page. Illinois has no comprehensive consumer privacy statute as of this writing.

Common questions about CCPA and CPRA compliance

Our company is in Illinois and has no California office. Does the CCPA apply to us?

It can. The definition asks whether the business does business in California, collects the personal information of California residents and meets one of the three thresholds (Cal. Civ. Code 1798.140(d)). It does not require an office in the state, so the question is answered on your facts.

Does the CCPA cover our employee and business-contact data?

Yes, if they are California residents. The California Attorney General states that the exemptions for employment-related information and for business-to-business transaction information expired on December 31, 2022.

We are a healthcare practice covered by HIPAA. Are we exempt?

Protected health information is outside the act, but the business is not. If you cross a threshold, your website, marketing and California employee data remain covered (Cal. Civ. Code 1798.145).

Do we have to honor the Global Privacy Control?

If your business is covered and sells or shares personal information, yes. The California Attorney General states that the signal must be honored as a valid opt-out request, and the regulations require a way for the consumer to confirm the status of that request.

Can consumers sue us for violating the CCPA?

Only for certain data breaches caused by a failure to maintain reasonable security (Cal. Civ. Code 1798.150). Other violations are enforced by the CPPA and the California Attorney General.

Related resources

General information only; not legal advice and does not create an attorney-client relationship.