California Cybersecurity Laws You Should Know (2025)

Mitch Wolverton

California is home to some of the strongest and most comprehensive cybersecurity and privacy laws in the United States. With its landmark consumer privacy legislation and strict data protection requirements, businesses operating in the state must take cybersecurity compliance seriously. Below, we outline the key California cybersecurity laws that apply to organizations in 2025.

California Cybersecurity Laws

California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA)

The California Consumer Privacy Act (CCPA), amended by the California Privacy Rights Act (CPRA), is one of the most robust data privacy laws in the nation. It grants California residents significant control over their personal data, including the right to:

  • Access the personal information a business collects about them
  • Request deletion of personal data
  • Opt out of data sales or sharing for targeted advertising
  • Correct inaccurate information
  • Limit the use of sensitive personal data

The CPRA, effective January 1, 2023, established the California Privacy Protection Agency (CPPA) to enforce these laws and created stricter data handling and cybersecurity requirements.

Businesses covered by the CCPA/CPRA include those that:

  • Have annual gross revenues over $25 million;
  • Buy, sell, or share personal data of 100,000 or more consumers or households; or
  • Derive 50% or more of annual revenue from selling or sharing personal data.

Violations can lead to civil penalties of up to $2,500 per violation, or $7,500 per intentional violation.

California Data Breach Notification Law (Cal. Civ. Code §§ 1798.29, 1798.82)

California was the first state to enact a data breach notification law in 2003. Businesses must notify affected individuals “in the most expedient time possible” after discovering a data breach involving personal information.

If the breach affects more than 500 California residents, businesses must also notify the California Attorney General.

The law requires notification even if encrypted data was breached and the encryption key was compromised.

California Online Privacy Protection Act (CalOPPA) (Cal. Bus. & Prof. Code §§ 22575–22579)

CalOPPA applies to any website or online service that collects personal information from California residents. It requires websites to:

  • Post a clear privacy policy detailing what data is collected and how it is used
  • Disclose how the site responds to “Do Not Track” (DNT) signals
  • Update their privacy policies as practices change

Failure to comply can be treated as an unlawful business practice under the California Unfair Competition Law (UCL).

California Shine the Light Law (Cal. Civ. Code § 1798.83)

This law gives consumers the right to request details about how businesses share their personal information with third parties for direct marketing purposes. Businesses must respond within 30 days of receiving a written request.

California Information Practices Act (IPA) (Cal. Civ. Code §§ 1798–1798.78)

The IPA governs the collection, maintenance, and dissemination of personal information by California state agencies. It requires secure handling of personal data and restricts sharing without authorization.

California Unfair Competition Law (UCL) (Cal. Bus. & Prof. Code §§ 17200–17210)

The UCL prohibits “unlawful, unfair, or fraudulent business practices,” including misrepresentation of cybersecurity standards or failure to protect consumer data.

California Penal Code – Computer Crimes (Cal. Penal Code §§ 502)

The California Computer Data Access and Fraud Act criminalizes unauthorized access to computers, systems, or data. Offenses such as hacking, phishing, and data theft can result in both civil and criminal penalties.

Federal and Industry-Specific Cybersecurity Regulations That Affect California Businesses

Payment Card Industry Data Security Standard (PCI DSS)

PCI DSS applies to California businesses that process credit card transactions. Compliance requires encryption, firewalls, and continuous vulnerability scanning to protect payment data.

Health Insurance Portability and Accountability Act (HIPAA)

HIPAA applies to California healthcare providers and business associates that handle personal health information (PHI). It mandates strict administrative, physical, and technical safeguards for protecting patient data.

Gramm-Leach-Bliley Act (GLBA)

Financial institutions in California must comply with GLBA, which requires written information security programs and transparent consumer privacy notices.

General Data Protection Regulation (GDPR)

GDPR applies to California businesses that collect or process personal data of EU residents. It requires explicit consent, the right to erasure, and transparency in data use.

Cybersecurity Requirements for Financial Services Companies (NYDFS 23 NYCRR 500)

California financial institutions operating in New York must comply with NYDFS cybersecurity regulations requiring encryption, multifactor authentication, and timely reporting of cyber incidents.

NIST Cybersecurity Framework

The NIST Cybersecurity Framework provides best practices that many California organizations follow to identify, protect, detect, respond to, and recover from cyber incidents.

Federal Trade Commission (FTC) Act

Under the FTC Act, California businesses must maintain reasonable cybersecurity protections and cannot mislead consumers about data security practices.

Children’s Online Privacy Protection Act (COPPA)

If your California business collects data from children under 13, COPPA applies. It requires verified parental consent and restricts data sharing.

Sarbanes-Oxley Act (SOX)

Publicly traded companies in California must comply with SOX, ensuring accurate financial reporting and internal control integrity.

Family Educational Rights and Privacy Act (FERPA)

FERPA applies to California schools and education vendors, protecting student data and requiring consent before disclosure.

Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA)

CIRCIA requires critical infrastructure organizations, such as those in energy, technology, and manufacturing, to report significant cyber incidents to CISA within 72 hours.

CAN-SPAM Act

The CAN-SPAM Act governs commercial email marketing practices, requiring truthful subject lines, accurate sender information, and opt-out options.

Defense Federal Acquisition Regulation Supplement (DFARS)

California defense contractors must comply with DFARS cybersecurity requirements aligned with NIST SP 800-171, ensuring data protection for controlled unclassified information.

Section 5 of the FTC Act (Unfair or Deceptive Practices)

Section 5 prohibits deceptive or negligent cybersecurity practices, holding California businesses accountable for protecting consumer information and privacy.

More California Cybersecurity Laws to Be Aware Of

The California Privacy Protection Agency (CPPA) enforces privacy and cybersecurity regulations statewide, while the California Department of Justice (DOJ) monitors and enforces data breach reporting.

California businesses are encouraged to:

  • Conduct regular cybersecurity and privacy impact assessments
  • Encrypt all sensitive personal and financial data
  • Maintain written cybersecurity and incident response programs
  • Follow frameworks such as NIST, CIS Controls, or ISO 27001

Strong cybersecurity governance not only ensures compliance but also builds long-term consumer trust.

Conclusion

California continues to set the national standard for cybersecurity and data privacy protection. From the CCPA/CPRA to the Data Breach Notification Law, the state’s framework demands transparency, accountability, and strong data protection.

If your organization needs help navigating California’s cybersecurity regulations, we offer compliance and security solutions tailored to your industry.

Frequently Asked Questions About California Cybersecurity Laws

  1. What is California’s main cybersecurity law?
    The California Consumer Privacy Act (CCPA) and its amendment, the CPRA, are the primary data privacy and cybersecurity laws in the state.
  2. How soon must California businesses report a data breach?
    Businesses must notify affected individuals as soon as possible after discovering a breach. If 500+ residents are affected, they must also notify the Attorney General.
  3. Who enforces California’s cybersecurity laws?
    The California Privacy Protection Agency (CPPA) and the Attorney General’s Office oversee enforcement of privacy and cybersecurity regulations.
  4. What penalties exist for noncompliance?
    Violations can result in fines up to $7,500 per intentional violation under the CCPA/CPRA, plus additional penalties for failure to report breaches.
  5. What cybersecurity frameworks are recommended for California businesses?
    Frameworks like NIST, CIS Controls, and ISO 27001 are recommended to strengthen compliance and cybersecurity posture.

Read More Cybersecurity Laws by State:

Florida Cybersecurity Laws You Should Know (2025)

Ohio Cybersecurity Laws You Should Know (2025)

Virginia Cybersecurity Laws You Should Know (2025)

North Carolina Cybersecurity Laws You Should Know (2025)

Disclaimer: This article is for informational purposes only and does not constitute legal advice. Readers should consult qualified legal counsel for advice specific to their organization or situation.

Mitch Wolverton

Mitch, Marketing Manager at PivIT Strategy, brings over many years of marketing and content creation experience to the company. He began his career as a content writer and strategist, honing his skills on some of the industry’s largest websites, before advancing to specialize in SEO and digital marketing at PivIT Strategy.