CCPA and AI: California privacy law for businesses using AI
· Written and maintained by Nonimo
The CCPA applies to AI the way it applies to any other processing: if your business meets one of California’s thresholds, the personal information you type into ChatGPT, Claude or Copilot is covered, and that includes your own employees.
California has also written AI into its privacy rules directly. The statute says personal information can live inside an AI system, and CalPrivacy, the state’s privacy agency, has made risk assessments mandatory since January 1, 2026, with rules on automated decisions from January 1, 2027.
This page is the California layer. The national picture, from HIPAA to the FTC, is in our guide to which AI tools comply with US privacy law, and every state law with its date is in the state by state overview. What follows is only what changes when the person in the document is a Californian.
Does the CCPA apply to your business?
The California Consumer Privacy Act reaches a company run for profit that does business in California, decides why and how personal information is processed, and meets at least one of three tests in Civil Code 1798.140(d). There is no exemption for using AI tools, and none for being headquartered in another state. A “consumer” is any natural person who is a California resident.
| Threshold | The figure in 2026 |
|---|---|
| Annual gross revenue in the preceding year | More than $26,625,000 |
| Personal information bought, sold or shared each year | 100,000 or more consumers or households |
| Revenue from selling or sharing personal information | 50% or more |
Civil Code 1798.140(d)(1). The revenue figure is CalPrivacy’s adjustment in force since January 1, 2025, read October 13, 2026.
The revenue figure moves. The statute still prints $25,000,000, but Civil Code 1798.199.95(d) indexes it to inflation every two years, in odd years, and CalPrivacy publishes the current number. A company that clears the bar is covered for all its Californians, customers and staff alike.
Employees and job applicants count here
For three years the CCPA carved out personal information collected about job applicants, employees, owners, directors and contractors. That exemption, in Civil Code 1798.145(m), became inoperative on January 1, 2023. Since then a California employee can ask what the company holds about them, ask for corrections and limit the use of sensitive details, like any customer.
That is the sharpest difference from Texas, whose privacy law leaves out anyone acting in an employment context, as our Texas page explains. For a California HR team, a performance review or a medical note pasted into a chatbot is CCPA data. The wider employment picture, from hiring tools to bias rules, is in our guide to AI for HR.
What California’s privacy law says about AI systems
California wrote AI into the definition itself. AB 1008, chaptered in 2024 as Stats. 2024, ch. 804, added Civil Code 1798.140(v)(4): personal information can exist in physical formats, in digital files, and in “abstract digital formats”, which the statute says include compressed or encrypted files, metadata and artificial intelligence systems capable of outputting personal information.
The practical reading is short. Once a customer’s details are inside a model or a chat history that can repeat them, they have not stopped being personal information because they changed shape. Rights to know and to delete still attach to them, which is why what OpenAI keeps from a conversation matters to a California business.
The attorney general’s advisory on existing law
On January 13, 2025, Attorney General Rob Bonta issued two legal advisories on how existing California law applies to AI, one general and one for healthcare. The general advisory reminds AI users that the CCPA requires collection, use, retention and sharing to be reasonably necessary and proportionate to the purpose, and bars processing for purposes that were never disclosed.
That proportionality test sits in Civil Code 1798.100(c), and it is the clause an AI use is easiest to fail. Summarizing a complaint rarely needs the customer’s Social Security number in the prompt. Removing what the task does not need is the cheapest way to pass it, and our guide to anonymizing data before AI separates what de-identifying achieves from what it does not.
Putting customer data into ChatGPT under the CCPA
Under the CCPA, handing personal information to an AI vendor is either a disclosure to a service provider or something worse. Civil Code 1798.140(ag) makes a vendor a service provider only when it receives the data under a written contract that bars it from selling or sharing it, from using it outside the business purposes in the contract, and from combining it with data from elsewhere.
Those three bans are what decide whether a chatbot account passes the California test. A consumer account accepted with a click rarely contains them; an enterprise agreement with a data processing addendum usually does. Which terms each provider offers is set out plan by plan in our Claude guide and our Copilot guide.
The contract finding in the Tractor Supply fine
On September 30, 2025, CalPrivacy’s board ordered Tractor Supply Company to pay $1,350,000, at the time the largest fine in the agency’s history. One of its four findings was disclosing personal information to other companies without contracts containing privacy protections. The decision was also the agency’s first on the privacy rights of job applicants.
None of the findings involved an AI tool. The logic transfers anyway: if a retailer can be fined for sending data to other companies without the right paper, a firm sending client files to a chatbot on a personal plan has the same gap. A US AI policy is where a company writes down which accounts may hold personal information.
Sensitive personal information: the list office paperwork trips over
The CCPA treats a defined set of details as sensitive personal information, in Civil Code 1798.140(ae), and a consumer can tell the business to limit their use under 1798.121. Most of the list turns up in ordinary office documents long before anyone thinks of biometrics.
| Sensitive personal information | Where it turns up |
|---|---|
| Social Security, driver’s license, state ID or passport number | Onboarding packets, rental and loan files |
| Account login or card number with its access code | Support tickets, password reset emails |
| Precise geolocation | Delivery notes, field service logs |
| Racial or ethnic origin, citizenship or immigration status, religion, union membership | HR files, I-9 support, benefits |
| Contents of mail, email and texts, unless you are the recipient | Forwarded threads |
| Health, sex life or sexual orientation; genetic, biometric and neural data | Leave requests, claims, medical notes |
Civil Code 1798.140(ae), as posted by CalPrivacy effective January 1, 2026.
A copy of a California driver’s license puts the first row on a single page. If a landlord or employer asks for one, our tool to watermark a California driver’s license marks who the copy is for, and the guide to redacting an SSN before AI covers the most common row.
CCPA risk assessments: required since January 1, 2026
The regulations CalPrivacy finalized in 2025 took effect on January 1, 2026, after the Office of Administrative Law approved them on September 22, 2025. Their Article 10 requires a business to conduct a risk assessment before it starts any processing that presents significant risk to consumers’ privacy, and section 7150(b) lists what counts.
Two items on that list catch everyday AI use. Processing sensitive personal information is one, with a narrow exception for employee payroll, benefits, work authorization and accommodation. Using automated decisionmaking technology for a significant decision is the other. The regulation’s own example of the first is a dating app disclosing users’ location and medical details to an analytics service provider.
The dates a California business works to
A company that begins sending sensitive personal information to an AI vendor in 2026 starts a listed activity, so the assessment comes first. Processing already running before 2026 gets a transition period. Section 7155 also requires a review at least every three years, an update within 45 calendar days of a material change, and keeping each version for as long as the processing continues or five years after the assessment is completed, whichever is later.
The submission under section 7157 is a summary, not the assessment itself: a contact, the period covered, how many assessments were done for each listed activity, and an attestation, under penalty of perjury, from a member of executive management. A cybersecurity audit is a separate duty, phased in for certifications due from April 1, 2028 for the largest businesses to April 1, 2030 for those under $50 million in revenue. Our US policy template gives the assessment somewhere to point.
The ADMT rules from January 1, 2027
The same package regulates automated decisionmaking technology, or ADMT, and gives businesses until January 1, 2027 to comply. Section 7001(e) defines ADMT as technology that processes personal information and uses computation to replace human decisionmaking or substantially replace it, which means using its output to decide without human involvement.
Human involvement has a definition too. The reviewer must know how to interpret the output, must review it along with any other relevant information, and must have authority to make or change the decision. The regulation excludes spellcheckers, calculators, databases and spreadsheets, provided they do not replace human decisionmaking.
What counts as a significant decision
The rules bite only where ADMT makes a significant decision under section 7001(ddd): one that results in providing or denying financial or lending services, housing, education enrollment or opportunities, employment or contracting opportunities or pay, or healthcare services. In employment that covers hiring, allocation of work, compensation, promotion, demotion, suspension and termination.
| The workflow | ADMT making a significant decision? |
|---|---|
| A recruiter asks Claude to summarize resumes, then reads them and decides | No: a person with authority reviews and decides |
| A screening tool rejects applicants and nobody reviews the result | Yes: hiring, with no human involvement |
| A spreadsheet ranks overtime requests that a manager approves one by one | No, unless the ranking replaces the manager’s decision |
Applying section 7001(e) and (ddd) of the CCPA regulations, effective January 1, 2026.
So the line runs through the workflow, not the product. The same chatbot can sit on either side, depending on whether anyone with authority looks at its output before the decision. Colorado draws a similar line with different duties, set out in our guide to the Colorado AI Act.
Pre-use notice, opt-out and access
A business in scope must give a Pre-use Notice at or before collecting the information it will run through ADMT, under section 7220, and offer an opt-out under section 7221 through at least two methods. The opt-out can be replaced by an appeal to a human reviewer with authority to overturn the decision, and some hiring and work allocation uses are excepted if the tool works for its purpose and does not unlawfully discriminate.
California’s Civil Rights Council adds a separate layer for employers. Its regulations on automated decision systems under the Fair Employment and Housing Act took effect on October 1, 2025, and require employment records, automated decision data included, to be kept for at least four years. Our HR guide covers how the two sets of rules sit together.
The CMIA: California’s medical privacy law outside HIPAA
The CCPA steps aside for medical information governed by the Confidentiality of Medical Information Act and for protected health information held by HIPAA covered entities, under Civil Code 1798.146(a). That does not leave the information unprotected. It moves it to the CMIA, which reaches businesses HIPAA never does.
The CMIA defines medical information in Civil Code 56.05 as individually identifiable information about a patient’s medical history, mental or physical condition or treatment, held by or derived from a provider, health plan, pharmaceutical company or contractor. A name, address, email, phone number or Social Security number is enough to make it identifiable. Our guide to HIPAA compliant AI covers the federal half.
Three places the CMIA reaches past HIPAA
First, Civil Code 56.06 treats a business offering software or apps designed to maintain medical information for diagnosis, treatment or self management as a provider of health care. Second, section 56.10(c)(3) lets a provider disclose to a company doing billing, claims management, medical data processing or other administrative services, but bars that company from disclosing it further in a way that would violate the CMIA.
Third, section 56.20 speaks to every employer. An employer that receives medical information must set up procedures to keep it confidential, and may not use or disclose its employees’ medical information without a signed authorization, outside listed exceptions. A doctor’s note in an HR inbox is CMIA material, which is exactly the gap our PHI and PII guide describes on the federal side.
The remedy is what makes the CMIA expensive. Under section 56.36(b), a person whose information was negligently released can sue for $1,000 in nominal damages without proving any actual damage, plus actual damages. Under section 56.36(c), administrative fines or civil penalties run up to $2,500 per negligent violation and up to $25,000 for knowing and willful ones by anyone other than a licensed health care professional.
California’s breach notice: 30 calendar days since 2026
SB 446 rewrote the timing in Civil Code 1798.82, effective January 1, 2026. A business that owns or licenses computerized personal information must notify affected Californians within 30 calendar days of discovering or being notified of the breach. The only allowed delays are a law enforcement request and the time needed to determine the scope and restore the system.
If more than 500 Californians are notified for one breach, a sample copy of the notice goes to the attorney general electronically within 15 calendar days of notifying them. The notice must be titled “Notice of Data Breach” and use the headings the statute prescribes. Whether a paste into a chatbot was a breach at all is a separate question, worked through in our guide on whether putting client data into ChatGPT is a data breach.
The private lawsuit, and the word “nonredacted”
California also lets the people affected sue. Civil Code 1798.150 gives a consumer a private right of action when their nonencrypted and nonredacted personal information is stolen or disclosed because the business failed to keep reasonable security. Statutory damages run from $107 to $799 per consumer per incident, or actual damages if higher, and the consumer must give 30 days’ notice to cure before suing for statutory damages.
The statute’s own wording points at the defense: the action covers nonencrypted and nonredacted information, so redaction is written into the text itself. That argues for redacting a PDF before AI rather than after.
Who enforces: CalPrivacy and the attorney general
California has a privacy regulator of its own. The California Privacy Protection Agency, which now calls itself CalPrivacy, enforces the CCPA through administrative fines, and the attorney general keeps the power to sue for civil penalties. Both sets of amounts are adjusted for inflation every two years, in odd years.
| Who | Under what | Maximum per violation |
|---|---|---|
| CalPrivacy | Civil Code 1798.155(a) | $2,663, or $7,988 if intentional or involving a known minor under 16 |
| Attorney general | Civil Code 1798.199.90(a) | The same amounts, as civil penalties |
| Consumers, after a breach | Civil Code 1798.150 | $107 to $799 per consumer per incident |
CalPrivacy, updated monetary thresholds effective January 1, 2025; read October 13, 2026.
CalPrivacy’s decisions so far show what it looks at first: privacy notices, opt-out mechanisms and contracts. Before Tractor Supply it fined American Honda $632,500 and the clothing retailer Todd Snyder $345,178. The largest CCPA penalty so far came from the attorney general: a $12.75 million settlement with General Motors, announced May 8, 2026 with CalPrivacy’s support. How enforcement works outside California, from attorneys general to the FTC, is in the national guide.
A California checklist for AI at work
Most of what this page describes lands on the same few documents. In the order a small or midsize California business can work through them:
- Check the contract. Each AI account that may hold personal information needs terms that make the vendor a service provider under 1798.140(ag). Check the plan, not the brand.
- List the sensitive fields. Match your prompts and uploads against the 1798.140(ae) table above, starting with driver’s license and Social Security numbers.
- Date the risk assessment. New processing of sensitive personal information needs one before it starts; older processing by December 31, 2027.
- Mark the decisions. Any tool that hires, assigns work, sets pay or grants credit with nobody reviewing falls under the ADMT rules on January 1, 2027.
- Find the medical notes. A doctor’s note that reaches the employer is CMIA material, and section 56.20 wants an authorization before the employer uses or discloses it.
- Rehearse the 30 days. The breach clock now leaves about four weeks from discovery to letters, with the attorney general’s copy 15 days later.
Item 5 is where the HIPAA guide’s de-identification list helps even outside a clinic, and item 1 is a line in your AI policy.
Nonimo in a California office
Nonimo is an app for Mac and Windows that works on the text before it reaches ChatGPT, Claude or Copilot. An HR coordinator in Sacramento highlights an onboarding email and presses one key, and the employee’s name, home address and Social Security number become placeholders on that computer. When the answer comes back, the real details go back in on the same machine.
For a California business that changes three things on this page: fewer items from the 1798.140(ae) list reach the vendor, a section 7150 risk assessment has less to describe, and what sits in the chat history is not the person’s identity. It does not replace the service provider contract, the notice or the assessment.
The conversation stays on the computer, encrypted, and what the app sends out is a daily usage count with no text, as the security page sets out. Start from Nonimo for US teams, or watermark a copy of a California driver’s license in your browser before sending it.
Sources
Read October 13, 2026 unless another date is given.
- CalPrivacy, California Consumer Privacy Act, effective January 1, 2026: Civil Code 1798.100(c) proportionality, 1798.121, 1798.140(d) thresholds, (v)(4)(C) AI systems, (ae) sensitive personal information, (ag) service providers, 1798.145(m) employee exemption inoperative January 1, 2023, 1798.146(a) medical exemption, 1798.150 private right of action.
- CalPrivacy, updated monetary thresholds: $26,625,000; $107 to $799; $2,663 and $7,988, effective January 1, 2025.
- CalPrivacy, CCPA regulations effective January 1, 2026: sections 7001(e) and (ddd), 7150, 7155, 7157, 7200, 7220 and 7221.
- CalPrivacy, rulemaking record: OAL approval September 22, 2025; effective January 1, 2026.
- CalPrivacy, announcement of September 23, 2025: risk assessments from January 1, 2026, submissions by April 1, 2028, ADMT from January 1, 2027, audit certifications 2028 to 2030.
- California Attorney General, General Motors settlement, May 8, 2026: $12.75 million, the largest CCPA penalty to date, with CalPrivacy’s support.
- CalPrivacy, Tractor Supply decision announcement, September 30, 2025: $1,350,000, contracts finding, job applicants, Honda and Todd Snyder fines.
- California Attorney General, legal advisories on AI, January 13, 2025, and the general advisory: AB 1008, Stats. 2024, ch. 804; necessary and proportionate.
- California Legislative Information, Civil Code 1798.82: 30 calendar days, sample to the attorney general within 15 days above 500 residents, amended by SB 446 (Stats. 2025, ch. 319), effective January 1, 2026.
- California Legislative Information, Civil Code 56.05, 56.06, 56.10, 56.20 and 56.36: CMIA definitions, software companies, administrative services, employers, damages and penalties.
- California Civil Rights Department, approval of the automated decision system regulations: effective October 1, 2025; records kept four years.
Common questions
Does the CCPA apply to AI tools like ChatGPT?
The CCPA regulates the business, not the tool. If your company meets one of its thresholds, typing a Californian's personal information into ChatGPT, Claude or Copilot is processing the law covers. Since AB 1008, the statute also says personal information can sit inside an AI system capable of outputting it. Nonimo replaces names and Social Security numbers on your computer before the text reaches the tool.
Is it legal under the CCPA to put customer data into ChatGPT?
It can be, on terms. The vendor has to receive the data under a written contract that makes it a service provider, the use has to be reasonably necessary and proportionate under Civil Code 1798.100(c), and sensitive personal information brings a risk assessment. CalPrivacy fined Tractor Supply partly for sharing personal information without such contracts. Nonimo cuts down what reaches the vendor in the first place.
Does the CCPA cover employee data?
Yes. The exemption for job applicants, employees and contractors in Civil Code 1798.145(m) became inoperative on January 1, 2023, so staff have the same rights as customers. CalPrivacy's Tractor Supply decision of September 30, 2025 was its first on job applicants' privacy rights. An HR file pasted into an AI tool is personal information under the CCPA, which Nonimo can redact on the workstation first.
What are the CCPA thresholds in 2026?
A business is covered if it does business in California and had more than $26,625,000 in annual gross revenue in the preceding year, or buys, sells or shares the personal information of 100,000 or more consumers or households, or makes half its revenue from selling or sharing it. The revenue figure is the one CalPrivacy set from January 1, 2025, and it is adjusted every two years, in odd years.
When do the CCPA ADMT rules start?
On January 1, 2027. A business using automated decisionmaking technology to make a significant decision about a consumer, such as hiring, pay, housing, credit, education or health care, must have its Pre-use Notice, opt-out and access rights in place by then. A chatbot that only helps a person who reviews its output and has authority to change the decision is outside the definition. Nonimo is not decision software: it removes identifiers from the text a person sends.
Do I need a CCPA risk assessment for using AI?
Often. Section 7150 of the regulations lists the triggers, including processing sensitive personal information, selling or sharing personal information, and using ADMT for a significant decision, and an assessment is due before new processing starts. Processing that began before 2026 has until December 31, 2027, and the first summary goes to CalPrivacy by April 1, 2028. Fewer identifiers reaching the vendor, which is Nonimo's job, simplifies what the assessment has to describe.
How long does a California business have to report a data breach?
Thirty calendar days from discovery or notification, since SB 446 took effect on January 1, 2026, with room to delay for law enforcement or to establish the scope. If more than 500 Californians are notified, a sample copy goes to the attorney general within 15 calendar days of notifying them. Whether a paste into an AI tool is a breach depends on the facts; our breach guide walks through it.
Does the CMIA apply if my business is not a medical practice?
It can. California's Confidentiality of Medical Information Act binds providers, health plans and their contractors, treats some health software companies as providers, and in Civil Code 56.20 tells every employer that receives medical information to protect it and not disclose it without authorization. A negligent release can cost $1,000 in nominal damages per person. Nonimo removes patient and employee identifiers before text leaves the computer.