California Codes

Cal. Civil Code § 1798.100 (2026)

✓ current as of May 2026

Find cases: SyfertCases citing this section CA-LEGleginfo.legislature.ca.gov JustiaCode on Justia CornellLII Search CasesGoogle Scholar

General Duties of Businesses that Collect Personal Information

(a)A business that controls the collection of a consumer’s personal information shall, at or before the point of collection, inform consumers of the following:

(1)The categories of personal information to be collected and the purposes for which the categories of personal information are collected or used and whether that information is sold or shared. A business shall not collect additional categories of personal information or use personal information collected for additional purposes that are incompatible with the disclosed purpose for which the personal information was collected without providing the consumer with notice consistent with this section.

(2)If the business collects sensitive personal information, the categories of sensitive personal information to be collected and the purposes for which the categories of sensitive personal information are collected or used, and whether that information is sold or shared. A business shall not collect additional categories of sensitive personal information or use sensitive personal information collected for additional purposes that are incompatible with the disclosed purpose for which the sensitive personal information was collected without providing the consumer with notice consistent with this section.

(3)The length of time the business intends to retain each category of personal information, including sensitive personal information, or if that is not possible, the criteria used to determine that period provided that a business shall not retain a consumer’s personal information or sensitive personal information for each disclosed purpose for which the personal information was collected for longer than is reasonably necessary for that disclosed purpose.

(b)A business that, acting as a third party, controls the collection of personal information about a consumer may satisfy its obligation under subdivision (a) by providing the required information prominently and conspicuously on the homepage of its internet website. In addition, if a business acting as a third party controls the collection of personal information about a consumer on its premises, including in a vehicle, then the business shall, at or before the point of collection, inform consumers as to the categories of personal information to be collected and the purposes for which the categories of personal information are used, and whether that personal information is sold, in a clear and conspicuous manner at the location.

(c)A business’ collection, use, retention, and sharing of a consumer’s personal information shall be reasonably necessary and proportionate to achieve the purposes for which the personal information was collected or processed, or for another disclosed purpose that is compatible with the context in which the personal information was collected, and not further processed in a manner that is incompatible with those purposes.

(d)A business that collects a consumer’s personal information and that sells that personal information to, or shares it with, a third party or that discloses it to a service provider or contractor for a business purpose shall enter into an agreement with the third party, service provider, or contractor, that:

(1)Specifies that the personal information is sold or disclosed by the business only for limited and specified purposes.

(2)Obligates the third party, service provider, or contractor to comply with applicable obligations under this title and obligate those persons to provide the same level of privacy protection as is required by this title.

(3)Grants the business rights to take reasonable and appropriate steps to help ensure that the third party, service provider, or contractor uses the personal information transferred in a manner consistent with the business’ obligations under this title.

(4)Requires the third party, service provider, or contractor to notify the business if it makes a determination that it can no longer meet its obligations under this title.

(5)Grants the business the right, upon notice, including under paragraph (4), to take reasonable and appropriate steps to stop and remediate unauthorized use of personal information.

(e)A business that collects a consumer’s personal information shall implement reasonable security procedures and practices appropriate to the nature of the personal information to protect the personal information from unauthorized or illegal access, destruction, use, modification, or disclosure in accordance with Section 1798.81.5.

(f)Nothing in this section shall require a business to disclose trade secrets, as specified in regulations adopted pursuant to paragraph (3) of subdivision (a) of Section 1798.185.

Notes of Decisions

Cited in 35 cases (32 in the last 5 years), 2018–2025 · leading case: Troester v. Starbucks Corp., 421 P.3d 1114 (Cal. 2018).

Sort: Relevance Newest Treatment

Troester v. Starbucks Corp., 421 P.3d 1114 (Cal. 2018). “(See Consumer Privacy Act of 2018, Civ. Code, § 1798.100 et seq. (added by Stats.”

Brandon Briskin v. Shopify, Inc., 135 F.4th 739 (9th Cir. 2025). “Specifically, the SAC alleges claims for invasion of privacy in violation of the California Invasion of Privacy Act, California Penal Code Sections 631(a), 635, and 637; data theft in violation of the California Computer Data Access and Fraud Act, California Penal Code Section…”

In Re: Aviva Kirsten v. California Pizza Kitchen, Inc., 129 F.4th 667 (9th Cir. 2025). “See CAL. CIV. CODE § 1798.100 et seq. That statute, under certain conditions, allows for statutory damages between $100 and $750 for California residents whose personal identifying information was “subject to an unauthorized access and exfiltration, theft, or disclosure as a…”

Netchoice, LLC v. Bonta, 113 F.4th 1101 (9th Cir. 2024). “See Cal. Civ. Code § 1798.100 (a)(1). The CCPA applies to “business[es],” defined as for-profit entities that meet certain threshold requirements.”

Untitled California Attorney Gen. Opinion (Cal. Att'y Gen. 2022). · cites it 4× “BACKGROUND The California Consumer Privacy Act of 2018 (Civil Code, §§ 1798.100 et seq.) is the first law of its kind in the nation.”

C.D. v. S.L. ca4/1 (Cal. Ct. App. 2022). “also appears to contend that the trial court violated her rights under the California Consumer Privacy Act of 2018 (Civ. Code, § 1798.100 et seq.), the Public Records Act (Gov.”

California Privacy Prot. Agency v. Super. Ct. (Cal. Ct. App. 2024). “) The California Consumer Privacy Act of 2018 Since the right of privacy was added to the California Constitution, various laws have been enacted by the Legislature to safeguard the informational privacy of Californians, including the California Consumer Privacy Act of 2018…”

Hadona Diep v. Apple, Inc. (9th Cir. 2024). “Cal. Civ. Code § 1798.100 (e); see also Md.”

(PS) Lewis v. AT&T (E.D. Cal. 2020). “He 5 might be attempting to allege a state law claim for violation of California’s Consumer Privacy 6 Act of 2018, Cal. Civ. Code §§ 1798.100 , et seq. Plaintiff, however, has yet to assert a properly- 7 pleaded federal cause of action which precludes supplemental jurisdiction…”

Voodoo SAS v. SayGames LLC (N.D. Cal. 2020). “The privacy 25 policy includes a section titled “Rights of California Residents,” which addresses requirements of 26 the California Consumer Privacy Act (“CCPA”), Cal. Civ. Code § 1798.100 et seq. See Levy 27 Decl.”

K. v. Google LLC (N.D. Cal. 2023). “contends that elsewhere in his complaint, he has alleged violations of COPPA and 23 the California Consumer Privacy Act, Cal. Civ. Code § 1798.100 . See Dkt. No. 25 at 5 (citing 24 Dkt.”

Katz-Lacabe v. Oracle Am., Inc. (N.D. Cal. 2023). “(Fla 2022) (unenacted) with Cal. Civ. Code §§ 1798.100 , et seq.). 9 Moreover, even though Florida relies on the Restatement, the Eleventh Circuit has noted, 10 specifically with respect to the private quarter requirement, that “the Supreme Court of Florida has 11 construed the…”

Show all 35 citing cases →

Annotations are extracted automatically from the opinions in the Syfert caselaw corpus and ranked by authority, recency, and treatment. Dots show Syfertize treatment of the citing case itself.