# Standards and Regulatory References

## Primary Legislation

### California Consumer Privacy Act (CCPA) — Cal. Civ. Code Section 1798.100 et seq.
- **Section 1798.100** — Right to know what personal information is collected
- **Section 1798.105** — Right to delete personal information
- **Section 1798.106** — Right to correct inaccurate personal information (added by CPRA)
- **Section 1798.110** — Right to know: categories and specific pieces of personal information
- **Section 1798.115** — Right to know about sale/sharing of personal information
- **Section 1798.120** — Right to opt-out of sale/sharing
- **Section 1798.121** — Right to limit use of sensitive personal information (added by CPRA)
- **Section 1798.125** — Non-discrimination
- **Section 1798.130** — Submission, verification, and response procedures
- **Section 1798.135** — "Do Not Sell or Share My Personal Information" link requirement
- **Section 1798.140** — Definitions (personal information, sale, share, business, consumer)
- **Section 1798.145** — Exemptions (employee data, B2B data until various sunsets)
- **Section 1798.185** — Rulemaking authority (California Privacy Protection Agency)
- **Section 1798.199.10-199.100** — California Privacy Protection Agency (CPPA) establishment (added by CPRA)

### California Privacy Rights Act (CPRA) — Proposition 24 (2020)
- Effective 01 January 2023
- Amended the CCPA to add the right to correct, right to limit use of sensitive PI, and the California Privacy Protection Agency

## Regulatory Guidance

### California Privacy Protection Agency (CPPA)
- **Final CCPA Regulations** (11 CCR Division 6): Implementing regulations covering verification requirements (Section 7060-7064), response procedures, and business obligations.
- **CPRA Rulemaking** (ongoing): Additional regulations implementing CPRA amendments including automated decision-making, risk assessments, and cybersecurity audits.

### California Attorney General
- **CCPA Fact Sheet**: Summary of consumer rights and business obligations.
- **Enforcement actions** (published on oag.ca.gov): Precedent-setting enforcement cases relevant to request processing requirements.

## International Comparison

### GDPR Alignment Points
- Right to know ≈ GDPR Art. 15 (right of access)
- Right to delete ≈ GDPR Art. 17 (right to erasure)
- Right to correct ≈ GDPR Art. 16 (right to rectification)
- Right to opt-out of sale ≈ GDPR Art. 21 (right to object) — but broader scope under CCPA
- Non-discrimination: unique to CCPA, no direct GDPR equivalent