CCPA, as amended by the CPRA, is the strictest and most actively enforced US state privacy law — policed by both the California Attorney General and a dedicated regulator, the CPPA. 2025 was a record enforcement year: Honda (), Todd Snyder (), Tractor Supply (.35M), and the AG's largest-ever CCPA settlement, Healthline (.55M). Nearly every case involved the same pattern AI-built apps ship by default — ad-tech SDKs sharing data with no working opt-out and no honored Global Privacy Control signal.
Get a Free Compliance Scan See Audit PricingCCPA applies to for-profit businesses doing business in California that meet any ONE of three thresholds. It protects California residents and households, and a consumer-facing app can cross the 100,000-user threshold faster than founders expect.
| Threshold | Detail |
|---|---|
| Revenue | Gross annual revenue over (CPI-adjusted, effective 2025-01-01) |
| Data volume | Buy, sell, or share the personal information of 100,000+ CA residents or households per year |
| Revenue mix | 50%+ of annual revenue comes from selling or sharing CA residents' personal information |
Penalties run up to per violation, or for intentional violations or any violation involving a minor under 16's data — and each affected consumer counts as a separate violation. The CPRA eliminated the mandatory 30-day cure period as of 2023-01-01; correcting a violation before enforcement is now discretionary, not guaranteed. There's also a private right of action for breaches of unencrypted personal information caused by a failure to maintain reasonable security: – per consumer per incident, or actual damages.
2025 enforcement: Healthline .55M (AG, largest CCPA settlement, GPC/opt-out failures); Tractor Supply .35M (CPPA's largest fine, no opt-out including GPC); Todd Snyder (broken opt-out portal ignored requests for 40 days); Honda (CPPA's first public fine, excessive verification, no ad-tech contracts).
Sources: cppa.ca.gov; oag.ca.gov/privacy/ccpa; oag.ca.gov news releases (Healthline, 2025-07-01); cppa.ca.gov announcements (Honda 2025-03-12, Todd Snyder 2025-05-06, Tractor Supply 2025-09-30).
| Requirement | What it means for your app |
|---|---|
| Privacy policy | Must state categories and purposes of data collected, retention, and what's sold or shared, and to whom. |
| "Do Not Sell or Share" link | Required on the homepage/footer, with a working opt-out that actually propagates to your ad and analytics partners. |
| Honor Global Privacy Control | Mandatory — the #1 enforcement theme. From 2026-01-01, revised §7025(c)(6) changes "may" to "must": you have to visibly display that the opt-out signal was processed. Opt-outs cannot require login or verification. |
| Sensitive PI limits | A "Limit the Use of My Sensitive Personal Information" link when SPI is used beyond permitted purposes; opt-in required to sell/share the PI of anyone under 16. |
| Deletion & access | At least two request methods, respond within 45 days, and cascade deletion to service providers and third parties. |
| Service-provider contracts | CCPA-mandated contract terms with every vendor that receives personal information — missing contracts were cited in the Honda, Healthline, and Tractor Supply actions. |
| New CPPA regs | Risk assessments for high-risk processing begin 2026-01-01; ADMT rules for "significant decisions" by 2027-01-01; annual cyber audits (250,000+ consumers' PI, or 50,000+ SPI) phased in 2028–2030 by revenue tier. |
Sources: cppa.ca.gov/announcements/2025/20250923.html; law.cornell.edu/regulations/california/11-CCR-7025; oag.ca.gov/privacy/ccpa/gpc; skadden.com (CPPA regs finalized).
Sources: oag.ca.gov (Sephora, 2022-08-24); oag.ca.gov news release (Healthline, 2025-07-01); cppa.ca.gov announcements (Todd Snyder, Honda); whitecase.com (Tractor Supply).
| Platform | CCPA posture |
|---|---|
| Lovable | Yes — public DPA (updated 2025-11-06) with a dedicated U.S. Privacy Laws section naming CCPA/CPRA; Lovable acts as service provider/contractor, won't sell or share your data. |
| Bolt (StackBlitz) | Partial — policy (2026-05-12) acknowledges CCPA, but DPAs are "where applicable" for enterprise only; no public self-serve CCPA DPA on free/Pro tiers. |
| Replit | Yes — public DPA expressly covering CCPA; acts as processor, won't sell data; subprocessor list published. |
| v0 / Vercel | Yes — DPA plus a dedicated California Privacy Addendum; Vercel commits to CCPA "service provider" status. |
| Base44 (Wix) | DPA exists, but explicit CCPA "service provider" language is unverified in public materials — review the actual text before relying on it. |
| Supabase | Self-service DPA + SCCs exist; explicit CCPA service-provider clause is unverified in the public summary — confirm in the signed document. |
Signing these DPAs is your job, not automatic for free-tier apps — and every builder DPA covers the platform itself, not the analytics or ad SDKs your generated app embeds.
Sources: lovable.dev/data-processing-agreement; stackblitz.com/privacy-policy; replit.com/dpa; vercel.com/legal/dpa; base44.com/dpa; supabase.com/legal/dpa.
Only if you meet one of three thresholds: gross annual revenue over buying/selling/sharing the personal information of 100,000+ California residents per year, or getting 50%+ of revenue from selling/sharing that data. Many small consumer apps still cross the 100,000-user threshold faster than expected.
GPC is a browser signal that tells a site to treat the visitor as opted out of sale/sharing. Honoring it is mandatory under 11 CCR §7025, and it's the single most-enforced CCPA requirement — it was central to both the Healthline and Tractor Supply enforcement actions in 2025.
Regulators have treated sending identifiers to ad-tech and analytics partners as "selling" or "sharing" since the Sephora settlement in 2022 — the same theory behind the 2025 Healthline case. Running GA4 or ad pixels without a working opt-out is a common CCPA violation.
No. Lovable and Replit both publish DPAs covering CCPA for their own platforms, but neither adds a "Do Not Sell or Share" link, a GPC listener, or a working deletion flow to the app you build — those have to be implemented in your own code.
CCPA requires a response within 45 days. Todd Snyder was fined by the CPPA in 2025 partly because its opt-out portal ignored requests for 40 days; missing the deadline or leaving a broken opt-out flow live is a documented enforcement trigger.
Penalties run up to per violation, or for intentional violations or any violation involving a minor's data, with each affected consumer counted separately. There's also a private right of action of – per consumer for breaches tied to inadequate security.
We audit AI-built apps against CCPA — GPC handling, opt-out mechanics, service-provider contracts — and hand you a fix-it list before the CPPA or AG finds the gap.
Get a Free Compliance ScanRelated searches: does CCPA apply to my small business website · CCPA compliance checklist for startups 2026 · do not sell or share my personal information link requirement · how to honor Global Privacy Control GPC on my website · CCPA fines for small business · is Google Analytics selling data under CCPA · CCPA vs CPRA difference · is my Lovable or Replit app CCPA compliant
