CCPA Compliance Explained: What Vendors Can Actually Show You

"What is CCPA compliance" is one of the most searched phrases in vendor security reviews, and the question quietly assumes something that does not exist: a certificate, seal or audit report labelled CCPA compliant that a vendor can hand you. The California Consumer Privacy Act, as amended by the California Privacy Rights Act, is a statute enforced by the California Attorney General and the California Privacy Protection Agency. No accreditation body issues a CCPA certificate, no auditor signs a CCPA report, and no registry lists verified CCPA vendors the way the Visa registry lists PCI DSS validations. What a vendor can actually show you lives in three ordinary documents: its privacy notice, its opt-out mechanism and its data processing terms. This article walks through how to read each one, and what the CCPA framework page in the CertReports index tracks instead of a badge.

CCPA and CPRA, in plain terms

The CCPA gives California residents rights over the personal information that businesses collect about them: the right to know what is collected, the right to delete it, the right to correct it, and the right to opt out of its sale or sharing. The CPRA, passed by ballot initiative in November 2020 and operative from 1 January 2023, expanded those rights, added a right to limit the use of sensitive personal information, and created the California Privacy Protection Agency as a dedicated regulator with rulemaking and enforcement power. A business falls under the law if it does business in California and meets one of three thresholds: annual gross revenue above a set figure, buying or selling the personal information of 100,000 or more consumers or households, or deriving 50% or more of annual revenue from selling or sharing personal information. None of that is assessed by an auditor. A business decides for itself whether it meets the thresholds and then is expected to comply with the obligations that follow.

Why there is no CCPA certificate to check

Frameworks such as SOC 2 and ISO 27001 work through a third party: an auditor or a certification body examines controls against a defined standard and issues a report or certificate that a vendor can publish. CCPA was never built that way. It is a consumer protection statute, not a management system standard, and it has no accreditation scheme sitting behind it. That is the same structural point worth remembering when a vendor claims GDPR compliance: both laws set legal obligations, and both are enforced through regulators and courts rather than through a certificate a vendor can frame. A vendor that claims to be CCPA certified or CCPA compliant in a marketing sense is describing an internal programme, not a credential you can verify against a public register. The evidence worth checking is the paperwork the law actually requires: a notice, a mechanism, and a contract.

The three things you can actually verify

Strip away the marketing language and a CCPA review comes down to three artefacts, each of which is either public or should be shared on request. The table below sets out what each one is for and where to find it.

Evidence	What it should contain	Where to find it
Privacy notice	Categories of personal information collected, purposes, categories of third parties, retention periods, and a description of consumer rights	Usually linked from the website footer, sometimes titled Privacy Policy or Privacy Notice for California Residents
Opt-out mechanism	A clear link titled Do Not Sell or Share My Personal Information, or an equivalent preference centre, and recognition of the Global Privacy Control signal	Website footer, cookie banner, or account privacy settings
Data processing terms	Contractual language defining the vendor as a service provider or contractor under CCPA, restrictions on using personal information for any purpose outside the services, and a subprocessor list	Master services agreement, data processing addendum, or trust centre legal page

Diagram showing the three pieces of public CCPA evidence: privacy notice, opt-out mechanism and data processing terms — CCPA has no certificate. These three documents are what a buyer can actually check.

Reading the privacy notice like an auditor

A privacy notice written for CCPA purposes should name the categories of personal information collected in the previous twelve months, using the statutory categories rather than vague language, and it should say whether any of that information has been sold, shared or disclosed for a business purpose. It should list the categories of third parties that receive data, state a retention period or the criteria used to set one, and describe how a consumer exercises their rights, including a toll-free number or an online request form. A notice that skips the sale and sharing disclosure, or that bundles California rights into a single global statement without specifics, is weaker evidence than one that addresses the state's categories directly. None of this requires an auditor's opinion. It is a document you can read in five minutes and compare against the statutory checklist.

Check the notice is dated and has a visible last-updated or effective date
Confirm it names categories of personal information using CCPA's defined categories, not generic marketing language
Look for an explicit statement on whether data is sold or shared, since silence is itself informative
Check that the rights section includes a verifiable request process, not just an email address

The opt-out mechanism: testing it yourself

The most concrete piece of CCPA evidence is also the easiest to test, because you do not need to ask the vendor for anything. You just use the mechanism.

1
Find the link
Look in the website footer, the cookie banner and the account settings for a link titled Do Not Sell or Share My Personal Information, or a combined preference centre that covers the same ground.
2
Check Global Privacy Control recognition
Enable a Global Privacy Control signal in a supported browser and reload the site. A vendor that respects CCPA opt-out obligations should treat the signal as a valid opt-out request without further action from you.
3
Submit a test opt-out
Where the mechanism allows it, submit a request and confirm you receive an acknowledgement, and that any tracking cookies tied to advertising or data sharing are disabled afterwards.
4
Note the response time
CCPA requires businesses to act on opt-out requests promptly. A mechanism that takes weeks to take effect, or that keeps resetting after each visit, is weak evidence even if the link exists.

Data processing terms and the subprocessor list

The third artefact sits in the contract, and this is the piece most buyers forget to check in a vendor review. CCPA requires that when personal information is disclosed to a service provider or contractor, a written contract restricts that party to the specific purposes for which the data was disclosed. In practice this means a data processing addendum naming the vendor as a service provider or contractor, listing permitted purposes, and often an accompanying subprocessor list showing who else touches the data downstream. A vendor's trust centre is a reasonable place to look for this, alongside its stance on cross-border transfer mechanisms, because the same page often covers both. The card below shows the kind of evidence worth checking: a data processing addendum, a subprocessor list, and the status of any transfer framework listing, rather than a CCPA badge that does not exist.

Look at the card's data processing addendum and subprocessor list rows rather than any headline figure, and note whether the Data Privacy Framework listing shown is current or lapsed, since vendors sometimes leave an old listing live after it has expired.

Notion · Trust report

Collaboration · Public evidence as of 19 Oct 2026

Visit trust centre Full evidence

Framework overview

CertReports state for each framework with public evidence: 11 vendor-stated, 1 expired.

3 more frameworks on the evidence page

3Documents and agreements

Legal and review documents Notion publishes or offers, as of 19 Oct 2026.

26Subprocessors

Named on Notion's public subprocessor list, last seen 19 Oct 2026.

Amplitude
Anthropic
AWS
BABaseten
CSCerebras Systems Inc.
Cloudflare
Confluent
Customer
and 18 more on the evidence page

A public DPA and a named subprocessor list are the CCPA-relevant evidence here, not the framework badges. Every line is a dated public record from Notion's trust centre and the Data Privacy Framework list. A framework not shown means no public evidence was found, not that Notion lacks it.CertReports

Buyers who already run a GDPR review often ask whether CCPA just duplicates it. The underlying questions overlap, but the legal mechanics differ enough that one does not substitute for the other, which is the same conclusion reached in Is GDPR applicable in the US? What the evidence shows. GDPR is built around a lawful basis for every processing activity and gives supervisory authorities broad investigative powers across the EU. CCPA is narrower in scope, built around disclosure, deletion and opt-out rights for California residents, and enforced primarily by the California Attorney General and the CPPA. A vendor can meet one set of obligations without automatically meeting the other, so a buyer checking both should expect two separate pieces of evidence: a GDPR-aligned data processing agreement referencing standard contractual clauses or an adequacy mechanism, and a CCPA-aligned service provider contract with its own opt-out and disclosure language.

The California Privacy Protection Agency is the first dedicated data protection regulator established by any state in the United States.
— California Privacy Protection Agency

What this means for your vendor review

Treat a vendor's CCPA posture the same way you would treat any other piece of public evidence: read the primary document rather than the marketing summary. A subprocessor list that is current and specific tells you more than a line in a security questionnaire that says the vendor is CCPA compliant. A working opt-out link tells you more than a badge. A dated data processing addendum tells you more than a sales call. If a vendor's trust centre groups CCPA alongside frameworks like SOC 2, ISO 27001 or the Data Privacy Framework, read our guide on how to read a trust centre for the general approach, and expect the CCPA row to point you to documents rather than a certificate number, since that is consistent with how the Data Privacy Framework, explained for vendor reviews also treats self-certification rather than third-party audit.

2018
CCPA signed into law: Enacted 28 June 2018; 2023
CPRA amendments operative: Operative from 1 January 2023, enforced from 1 July 2023; $7,500
maximum civil penalty per intentional violation: California Civil Code §1798.155(b); 0
CCPA certificates that exist: No accreditation body issues one; the index on 2026-10-15 lists public evidence pages instead

Chart comparing CCPA and GDPR across scope, rights and enforcement body — CCPA and GDPR ask related questions through different legal mechanics.

What to ask for instead of a badge

Skip the question "are you CCPA compliant" and ask three specific things: a link to the current privacy notice with a last-updated date, a working opt-out or Global Privacy Control mechanism you can test yourself, and the service provider or contractor clause in the data processing addendum. All three are checkable without taking the vendor's word for it.