CCPA compliance for apps in 2026: which state privacy laws apply, what to build (consent, DSAR, deletion), real fines, and what it costs to do right.
CCPA compliance for apps in 2026 comes down to four things: clear notice at collection, a working opt-out of sale and sharing (including Global Privacy Control signals), access and deletion requests answered within 45 days, and reasonable security. Roughly 20 state laws add wrinkles; build for California and you cover most.
The California Consumer Privacy Act, as amended by the CPRA, gives California users a specific set of rights your app has to honor in software, not in a PDF. The lists them plainly:
Two details trip up app teams. You have 45 days to respond to a request, extendable once by another 45 if you notify the user. And since 2023, California enforcers no longer have to give you a 30-day cure period before penalties.
CCPA compliance is not a banner you paste in. It is plumbing: a data inventory, a request pipeline, and consent state that every SDK in your app respects.
California moved first, but the real question in 2026 is which of the state privacy laws apply to you this quarter. The IAPP US State Privacy Legislation Tracker tracks every bill and effective date. The comprehensive laws now in effect include:
| State | Law | In effect | What stands out |
|---|---|---|---|
| California | CCPA/CPRA | 2020 / 2023 | Dedicated regulator (CPPA), applies to employee and B2B data |
| Virginia | VCDPA | Jan 2023 | Opt-in consent for sensitive data |
| Colorado | CPA | Jul 2023 | Universal opt-out signals mandatory since Jul 2024 |
| Connecticut | CTDPA | Jul 2023 | Strong minors' data provisions |
| Texas | TDPSA | Jul 2024 | Applies to almost any business, active AG enforcement |
| Oregon | OCPA | Jul 2024 | Users can request the named list of third parties that got their data |
| Maryland | MODPA | Oct 2025 | Strict data minimization, ban on selling sensitive data outright |
| Minnesota | MCDPA | Jul 2025 | Right to question profiling decisions |
Montana, Delaware, New Jersey, New Hampshire, Nebraska, Iowa, Tennessee, and more round out the list, with Indiana, Kentucky, and Rhode Island arriving in January 2026. Most of these follow the Virginia model, so a California-plus-Virginia build covers the bulk. Maryland is the outlier: its rule to collect only what the requested service needs is a design constraint, not a disclosure requirement.
The thresholds are concrete. CCPA applies to a for-profit business that does business in California and meets any one of these:
The second threshold is the one that catches app startups. "Sharing" data with an ad SDK counts, and California is about 12 percent of the US market, so an app with roughly a million US installs and a standard ad-monetization stack is very likely in scope. Texas, by contrast, dropped revenue thresholds almost entirely; small teams are covered the day they process Texans' personal data.
Health data changes the analysis again: HIPAA covers some of it, state laws cover the rest, and Washington's My Health My Data act reaches inferences most teams don't realize they generate. We covered the overlap in our guide to healthcare mobile app development and HIPAA compliance.
Here is the engineering checklist we run on every consumer-facing build. None of it is exotic, and all of it has to exist before the first enforcement letter arrives.
You cannot delete what you cannot find. Map every field of personal data to where it lives: database, analytics, crash reporting, email tools, support desk, warehouse, backups. Most teams find 2-3 SDKs collecting data nobody remembers adding. The inventory also keeps your App Store privacy nutrition label accurate, and users read those; a flashlight app requesting contacts gets flagged in reviews.
Your consent layer needs to know where the user is and show the right experience: "Do Not Sell or Share My Personal Information" for California, opt-in for sensitive data in Virginia-model states, GDPR consent if you serve the EU. Consent state has to propagate: if a user opts out and your attribution SDK keeps firing, the banner just documented a promise you break.
GPC is a browser and OS-level signal that says "opt me out everywhere". California and Colorado require you to honor it, and it was the core of the very first CCPA enforcement action. This is a real technical task: read the signal, flip the user's opt-out state, suppress the ad-tech calls.
Access, deletion, and correction requests need an intake form, identity verification, fan-out to every system in your inventory, and an audit log proving you did it on time. At low volume a tracked manual process works. Past a few requests a week, automate it.
From the field: the pattern we keep meeting is the 2am ops shift, where a human bridges tools that don't talk to each other. Privacy requests are the newest version of it: a deletion email arrives, and someone manually hunts the user down across the CRM, the analytics dashboard, and the warehouse, hoping they found every copy. That gap is usually one integration and one agent away from gone, and it is a better first automation project than most chatbots.
Every processor touching personal data needs a data processing agreement with deletion obligations. "Reasonable security" is a legal duty under CCPA, with a private right of action worth $100-$750 per consumer per incident when negligence leads to a breach. Our zero-trust security architecture guide for mobile apps covers the technical baseline we build to.
The penalty schedule: up to $2,500 per unintentional violation and $7,500 per intentional violation or any violation involving minors under 16. "Per violation" is typically read per consumer, per incident, which is how numbers get large quickly.
The enforcement record is no longer theoretical. Sephora paid $1.2 million in 2022, largely for ignoring GPC signals. In 2025 the California Privacy Protection Agency fined Honda $632,500 over a rights-request process that demanded more information than allowed, and Texas runs its own aggressive sweeps against apps and data brokers. Regulators in California, Colorado, and Connecticut now coordinate investigations, so one complaint can become a multi-state problem.
The quieter cost is trust. Most iOS users decline tracking prompts, which killed the third-party data economy and made first-party data the asset that matters. Apps that explain requests in context ("we need photo access to build this collage") see far higher opt-in rates than apps that ambush users at launch. Privacy is a conversion lever, not just a legal shield.
Here is the opinion we hold after 30+ production builds since 2024: privacy by design is the cheap option. Adding a consent layer, a data inventory, and a deletion pipeline during architecture costs days. Retrofitting them into a shipped product with five SDKs, three databases, and no data map costs weeks and usually a painful migration.
Practical design moves that pay for themselves:
When we scope a SaaS or app build, this is baked into the architecture phase, not sold as an add-on. A typical 4-8 week engagement in the $8,000-$60,000 range includes the data inventory, consent management, and DSAR plumbing from day one, because doing it later is how budgets die.
Only if you cross a threshold: $25 million+ revenue, data on 100,000+ California consumers or households, or half your revenue from selling or sharing data. Many pre-revenue apps are exempt from CCPA specifically. But Texas and a few other states have no such floor, so "we're too small for privacy law" is no longer a safe assumption.
Mostly, not entirely. California is the strictest baseline for opt-outs and GPC, so building to it covers the majority of Virginia-model states. The gaps: opt-in consent for sensitive data (Virginia, Colorado, Connecticut), Oregon's third-party list disclosure, and Maryland's hard data minimization rule. A California-plus-Virginia build with a state matrix review closes them.
45 days under CCPA, extendable once by another 45 days if you notify the user with a reason. Most Virginia-model states use the same clock. The deadline covers the full job: verifying identity, deleting across every internal system, and instructing your processors to delete their copies. An audit log of each step is what protects you if a regulator asks.
Not the EU-style "accept cookies" wall. US law is opt-out by default: you can collect and process data, but you must offer a clear "Do Not Sell or Share" mechanism, honor GPC signals automatically in California and Colorado, and get opt-in consent before touching sensitive data in most Virginia-model states. Geo-aware consent tooling shows each user the experience their state requires.
As part of a new build, the marginal cost is small: consent management, a data inventory, and DSAR plumbing fit inside a normal 4-8 week engagement at $8,000-$60,000 fixed price. Retrofits vary widely with SDK sprawl and data debt. Automating an existing manual DSAR process is typically a single-purpose workflow project on the smaller end of that range.
If you are launching a US app in 2026, the privacy work is a known, buildable checklist, far cheaper to include now than to retrofit under an enforcement deadline. We take on two engagements per quarter, and every client gets 100% code ownership, so the compliance plumbing is yours, documented and auditable.
Book a free 30-minute scoping call and we will map your data flows, flag which state laws apply, and give you a fixed-price plan. We respond within two business days. Start your project or see how we approach SaaS development builds with privacy designed in.
A serial maker of SaaS products and AI agents, I’ve built and launched 10+ tools, grown products to thousands of users, and taken multiple ventures. I share the process what works, what breaks, and how builders can ship faster and smarter.
