CCPA security awareness training
CCPA training is a named rule, not a best practice. Regulation §7100 says anyone handling consumer privacy inquiries must know the requirements and how to route a request.
Five-to-ten-minute 3D exercises mapped to each CCPA duty, with completion evidence your auditor can export.
At a glance
- Training rule
- 11 CCR §7100: staff who handle consumer inquiries must know the rules
- Response clock
- 45 calendar days, one extension to 90 in total
- Fines (2025)
- Up to $2,663 per violation, $7,988 if intentional
- Breach suits
- $107 to $799 per consumer per incident under §1798.150
A consumer request sets five deadlines
The regulations count from the day the request arrives, not the day someone notices it.
- 10 days Confirm receipt Business days to confirm a request to delete, correct or know, and explain what happens next (§7021).
- 15 days Stop selling or sharing Business days, at most, to act on an opt-out or a request to limit sensitive data use (§7026, §7027).
- 45 days Answer the request Calendar days to respond. The count starts on receipt, even while identity checks are still running.
- 90 days Hard ceiling One extra 45 days is allowed if the consumer is told why.
- 24 months Keep the record How long a business must retain each request and how it responded (§7101).
Request clocks come from 11 CCR §7021 and the effective text of 1 January 2026.
What the statute and the regulations ask of staff
Which sections reach your staff, and which ones only reach the privacy team.
01 §7100(a): everyone who fields privacy questions
This covers more people than the privacy team. Support agents, store staff, the call centre and whoever reads the privacy@ mailbox all handle consumer inquiries.
They need to know the rights a Californian has and where each request goes. A request rarely says "CCPA" in the subject line.
02 §7100(b): a written policy at 10 million consumers
Large data businesses must document a training policy and follow it. The same threshold triggers §7102, which requires publishing yearly request metrics, including how many requests were denied and the median or mean response time.
Those numbers come straight from how well front-line staff route requests.
03 Verification without overreach
Staff must confirm who is asking before releasing or deleting data. They may not demand identity checks for an opt-out of sale or sharing.
Honda and Todd Snyder were both penalised for asking for more information than a request needed. The fraud check and the opt-out are different flows, and staff need to tell them apart.
04 Records kept for 24 months
Section 7101 requires a log of every consumer request and the response, kept for at least 24 months. The log may not be used for anything else, apart from reviewing your own compliance process.
If a request was missed because nobody recognised it, that gap is visible in the log.
05 Reasonable security and the 2026 regulations
Regulations effective 1 January 2026 add cybersecurity audits, risk assessments and rules on automated decisionmaking technology.
- Audit certifications start 1 April 2028 for businesses over $100 million in revenue, then 2029 and 2030 for smaller ones.
- Risk assessment attestations are due 1 April 2028.
- ADMT rules for significant decisions apply from 1 January 2027.
06 How the CCPA / CPRA path is built
The path has four steps: GDPR Compliance, Protecting Sensitive Information, Phishing & Impersonation Attacks, and Incident Reporting. It recurs every 12 months, so the annual refresh is assigned without anyone remembering to do it.
We do not have a California-specific privacy course. The first step is GDPR-framed, and we say so.
What carries over is the work itself: spotting a rights request, checking a suspicious one, handling consent, redacting before release, responding to a breach and vetting vendors. A CCPA request needs the same habits with different deadlines.
Every completion lands in the record: a PDF certificate per learner, a tenant-wide CSV, the compliance report page, and an automatic sync to Vanta or Drata for teams running their audits there.
Enforcement that came down to request handling
Three recent cases where the request process, not a hacker, was the problem.
American Honda, $632,500 (CPPA, March 2025)
The CPPA Enforcement Division found that Honda made consumers verify identity and hand over extra data to opt out, made authorised agents jump through hoops, offered unequal privacy choices, and shared data with ad tech firms without the required contract terms.
The order requires Honda to train its employees and bring in a UX designer to review its request methods.
Todd Snyder, $345,178 (CPPA, May 2025)
Opt-out requests through the retailer's privacy portal went unprocessed for 40 days because nobody had configured it properly. The company also asked for identity verification before an opt-out.
The decision orders CCPA compliance training for employees. The agency's enforcement head said a consent management platform does not get a business off the hook.
Healthline Media, $1.55 million (Attorney General, July 2025)
The AG alleged Healthline kept sharing data with advertisers after consumers opted out, including through Global Privacy Control signals. Its consent banner implied that unchecking a box stopped tracking cookies, and it did not.
The settlement requires a CCPA compliance program, including audits of advertising contracts.
Four courses, one annual assignment
The CCPA / CPRA path starts with a privacy-handling course and ends with incident reporting, and reassigns itself every 12 months.
- Request handling, honestly labelled
- The privacy course is written around GDPR. Its DSAR, fraud-check, consent and redaction exercises train the same moves a CCPA request needs.
- Data and attackers
- Protecting Sensitive Information and Phishing & Impersonation Attacks cover the causes behind a §1798.150 breach claim.
- Proof per person
- PDF certificate per learner, tenant CSV, a compliance report page, and sync to Vanta or Drata.
CCPA duties next to the exercises that drill them
Each line pairs a statute or regulation section with a scenario where staff make that decision.
§1798.100 / .105 Right to Know & Delete §1798.120 Right to Opt-Out of Sale or Sharing §1798.121 Right to Limit Sensitive PI Use (CPRA) §1798.140 Personal Information Inventory §1798.150 Breach Notification & Private Right of Action Recommended exercises
Request intake, identity checks, opt-outs and breach escalation.
- Legitimate DSAR Processing A rights request arriving by chat or phone without any legal wording. The same recognition step starts the 45-day CCPA clock. Try the exercise
- Fraudulent DSAR Detection Someone asks for another person's data. Practises the check that §7060 expects for requests to know or delete. Try the exercise
- Marketing Consent Management Consent records and preference changes, the area where Healthline's banner promised more than it did. Try the exercise
- PII Document Redaction Cleaning a response so a request to know does not hand over a third person's details. Try the exercise
- Third-Party Data Processor Vetting Asking for contract terms before a vendor gets data. Missing terms appear in both the Honda and Healthline cases. Try the exercise
- Data Breach Response Escalating a suspected breach quickly, before it becomes a §1798.150 claim. Try the exercise
- Data Classification Basics Telling ordinary personal information from sensitive personal information, which carries its own right to limit. Try the exercise
- General Incident Reporting Who to tell and what to write down when something looks wrong. Try the exercise
Controls that sit beside the training
Controls that make §7100 training stick once people are back at their desks.
One intake path for every channel
Requests arrive by email, chat, phone and in stores. Give staff one place to log them so the 45-day count starts on time.
The Legitimate DSAR Processing exercise practises spotting a request written in plain words.
Two verification standards, written down
Requests to know or delete need identity checks. Opt-outs and requests to limit do not.
Put both rules in the script support uses, and practise the fraud side with Fraudulent DSAR Detection.
Test the opt-out after every change
Todd Snyder lost 40 days to a misconfigured portal. After each release or vendor change, submit a test opt-out and a Global Privacy Control signal and check that both are honoured.
Contract terms before data moves
Honda and Healthline both shared data with ad tech partners without the required terms. The Third-Party Data Processor Vetting exercise trains procurement to ask before a vendor receives anything.
Redact before you respond
A response to a request to know can leak another person's data. PII Document Redaction practises cleaning files, threads and metadata before they go out.
Report fast, then decide
A stolen laptop or a phished mailbox can turn into a §1798.150 claim. The Incident Reporting course trains staff to raise it first and let the security team classify it.
Further reading
Related glossary terms
References
- CCPA Regulations, 11 CCR §7000 et seq. (effective 1 January 2026) California Privacy Protection Agency
- California Finalizes Regulations to Strengthen Consumers' Privacy California Privacy Protection Agency
- CCPA monetary thresholds, fines and damages adjusted for 2025 California Privacy Protection Agency
- Honda Settles With CPPA Over Privacy Violations California Privacy Protection Agency
- CPPA Orders Clothing Retailer Todd Snyder to Pay Six-Figure Fine California Privacy Protection Agency
- Attorney General Bonta Secures $1.55 Million from Healthline.com California Attorney General
Train the people who answer the privacy inbox
An annual CCPA path with per-learner records you can hand to the CPPA.
Frequently asked questions
What is CCPA security awareness training?
CCPA training is how a business shows that the people answering privacy requests know the law. The CPPA regulations require it in §7100, and recent orders against Honda and Todd Snyder made employee training part of the remedy.
Does the CCPA require employee training?
Yes, for a defined group. 11 CCR §7100(a) says everyone responsible for handling consumer inquiries about privacy practices or CCPA compliance must be informed of the requirements and how to direct consumers to exercise their rights.
Businesses handling the personal information of 10 million or more consumers a year also need a documented training policy under §7100(b).
Who counts as handling consumer inquiries?
Anyone a consumer might ask about their data. That usually means customer support, call centres, retail staff, the privacy mailbox owner, and marketing teams that manage unsubscribes and preferences.
Training only the privacy lead does not reach the people who receive most requests.
How fast must a business respond to a CCPA request?
Confirm receipt within 10 business days and respond within 45 calendar days, with one 45-day extension if the consumer is told why. Opt-outs of sale or sharing must be honoured within 15 business days at most.
The 45 days run from receipt, regardless of how long verification takes.
What are the CCPA penalties in 2025 and 2026?
From 1 January 2025 the CPPA adjusted administrative fines to up to $2,663 per violation and $7,988 per intentional violation or violation involving consumers under 16.
Statutory damages in a data breach suit under §1798.150 are $107 to $799 per consumer per incident, or actual damages if higher.
Is a GDPR course enough for CCPA training?
Not on its own. The deadlines, the opt-out of sale or sharing, the right to limit sensitive data use and the ban on verifying opt-outs are Californian.
Our path uses a GDPR-framed course for the shared skills and expects your privacy team to add your own request procedure and contacts.
How often should CCPA training run?
The regulations set no frequency. Our path reassigns every 12 months, and new staff in request-handling roles should finish it before they answer consumers.