CCPA Audit Checklist in 2026: 7 Live Checks for Notices, Opt-Outs, and Proof

If you are searching for a ccpa audit checklist on October 16, 2026, the useful question is not whether your company has a privacy policy somewhere in the footer.

The useful question is whether your notices, request methods, opt-out handling, vendor controls, and internal evidence still match the way your systems actually collect, use, retain, and share personal information this week.

That matters even more after California’s 2026 enforcement cycle. The state’s current materials still lay out concrete CCPA scope thresholds, rights, notice duties, request paths, and opt-out rules. And recent public enforcement outcomes show that California is not only checking paperwork. It is checking whether account-level opt-outs, data minimization, downstream sharing, and live consumer choices really work.

If you want nearby context first, start with our guides to California web privacy law, California privacy law delete data, and CCPA cookie consent requirements. This article is broader. It is the ccpa audit checklist I would use before telling leadership the California program is in shape.

1. Confirm that the business is actually in CCPA scope

Every solid ccpa audit checklist starts with scope, because teams often audit the wrong perimeter.

The CPPA’s current FAQ still says the CCPA applies to for-profit businesses that do business in California, determine why and how personal information is processed, and meet one of the statutory thresholds. As of late 2026, those thresholds still include annual gross revenue of $26.625 million or more, buying, selling, or sharing the personal information of 100,000 or more California residents or households, or deriving 50% or more of annual revenue from selling or sharing Californians’ personal information.

That scoping step should also cover affiliates, service providers, contractors, and any business unit that is quietly collecting data for another part of the organization. California’s own definitions are broad enough that a weak intake map can distort the rest of the audit.

So before the checklist gets into rights or notices, ask:

1. Which entity is the business for CCPA purposes?
2. Which apps, websites, products, and connected services collect California data?
3. Which personal information categories and sensitive personal information categories are in play?
4. Which third parties receive data because of advertising, analytics, support, enrichment, or product integrations?

If the scope map is fuzzy, the rest of the ccpa audit checklist will be too.

2. Compare the privacy policy and notices against live data flows

The next check is not only whether a policy exists. It is whether the written disclosures match the runtime.

California’s current regulations still require the privacy policy to be posted online through a conspicuous link using the word privacy on the homepage, app landing page, or app settings area. In practice, that means your ccpa audit checklist should not stop at reading policy copy in isolation. It should compare the policy against the actual categories collected, purposes stated, third parties involved, and rights paths exposed on the live property.

This is also where recent enforcement should sharpen the review. In the May 8, 2026 General Motors settlement announcement, California alleged that GM sold location and driving data without adequate notice and in ways that contradicted its own privacy messaging. That is a reminder that a pretty privacy page does not help if ad-tech, connected-device telemetry, or customer-data flows say something else.

For this part of the ccpa audit checklist, test:

• whether the categories collected still match the real systems;
• whether sale or sharing disclosures are accurate and specific enough;
• whether sensitive-data uses are described honestly;
• whether retention and downstream-recipient language reflect current practice; and
• whether every linked notice still loads and works on mobile as well as desktop.

If the policy reads like a legal artifact from an older stack, the audit should treat that as a live defect.

3. Test request intake, routing, and deadline handling

This is one of the clearest parts of the law, and one of the easiest places to catch operational drift.

The CPPA FAQ still says businesses generally must provide at least two methods for consumers to submit requests to delete, correct, or know their personal information. One method must be a toll-free number and, if the business has a website, one method must be through the website. The same FAQ also still says businesses must confirm receipt within 10 business days and respond within 45 calendar days, with a possible extension to 90 days when reasonably necessary.

A serious ccpa audit checklist therefore needs live testing, not policy review alone. Submit real test requests through every listed path and confirm that:

1. the method works on the current site or app;
2. the request is classified correctly on intake;
3. the requester receives the acknowledgement on time;
4. the ticket routes to privacy, support, engineering, or product owners correctly; and
5. the final response can be completed inside the statutory window.

This is also where record-keeping discipline starts. California’s regulations still require businesses to keep request records and response information for at least 24 months. If your team cannot show the request log, denial basis, and response timing, the audit evidence is incomplete even if the program sounds mature in meetings.

4. Audit opt-out of sale or sharing, GPC, and choice design

For many teams, this is the highest-risk section of the ccpa audit checklist.

California’s DOJ still describes Global Privacy Control as a browser-level “stop selling or sharing my data switch.” The CPPA FAQ still says covered businesses must honor qualifying opt-out preference signals, and the regulations still require that consumer-facing methods be “easy to execute” and respect “Symmetry in choice.”

That means your audit should test more than whether a Your Privacy Choices link exists.

Test whether the business:

1. offers a working opt-out path where sale or sharing exists;
2. honors GPC in the browser and in relevant account or profile contexts;
3. avoids extra steps on the more privacy-protective path;
4. avoids interfaces that amount to dark patterns;
5. propagates the opt-out across connected products where the account structure makes that necessary.

The recent Disney settlement is a sharp example. On February 11, 2026, Attorney General Rob Bonta announced a $2.75 million CCPA settlement tied to failures to fully effectuate opt-outs across Disney+, Hulu, and ESPN+ properties associated with a consumer account. Bonta said asking a business to stop selling data “should not be complicated or cumbersome.”

So for this part of the ccpa audit checklist, do not only test a single browser click on a single page. Test the account graph.

5. Review service-provider, contractor, and third-party controls

A weak CCPA program often breaks after the consumer request leaves the front door.

California’s regulations still require service-provider and contractor agreements to enable the business to comply with consumer requests. In other words, your ccpa audit checklist should verify that downstream contracts and workflows let the business carry requests through to the systems and vendors that actually hold or use the data.

This review should cover:

• service providers and contractors that process customer, marketing, analytics, support, or loyalty data;
• third parties receiving data through sale, sharing, or other disclosures;
• delete and correction workflows with vendors;
• opt-out propagation to ad-tech and measurement partners; and
• proof that contracts limit use to the specified business purpose.

The legal issue here is practical: if the business promises deletion, correction, limitation, or opt-out, but its downstream stack cannot honor that promise, the business still owns the problem.

6. Check sensitive personal information and limit-right handling

This is the part of a ccpa audit checklist that many teams still under-test.

The CPPA FAQ still says consumers have the right to limit the use and disclosure of sensitive personal information in covered situations. The regulations also still say requests to limit must be easy to submit, should not require account creation, and should not require more information than necessary. Once a valid request to limit is received, the regulations still require businesses to stop the covered use or disclosure as soon as feasibly possible and no later than 15 business days.

That makes the audit questions concrete:

1. Do you actually use or disclose sensitive personal information beyond the limited statutory purposes?
2. If yes, do you expose the required Limit the Use of My Sensitive Personal Information or combined privacy-choices path where appropriate?
3. Does the path work without extra friction?
4. Can the business tell vendors and downstream recipients to comply inside the required window?

Sensitive-data review is also a useful data-minimization test. If the business is collecting precise geolocation, financial data, health data, or other sensitive categories with weak internal ownership, the CCPA audit should treat that as a priority finding.

7. Verify proof: training, metrics, risk assessments, and cybersecurity audit readiness

The last part of the ccpa audit checklist is proof.

California’s regulations still require that staff responsible for handling consumer inquiries be informed about CCPA requirements. Businesses processing information at very large scale have extra training and annual metrics duties, including public disclosure by July 1 of request volumes and average response timing when the business knows or reasonably should know it handles personal information for 10,000,000 or more consumers in a year.

This is also where 2026 brought new pressure on privacy governance. The CPPA’s finalized 2025 rulemaking package became effective on January 1, 2026. The agency said businesses subject to risk-assessment requirements had to begin compliance on that date, with required submissions beginning April 1, 2028 for 2026 and 2027 assessments. The same package phased in cybersecurity audit reporting beginning April 1, 2028, April 1, 2029, or April 1, 2030, depending on revenue and risk criteria.

So the final branch of your ccpa audit checklist should ask:

1. can the business produce training records;
2. can it produce the 24-month request log and denial basis;
3. if large-scale metrics disclosure applies, is the July 1 posting accurate;
4. if risk-assessment rules apply, are the assessments actually being performed and documented now;
5. if cybersecurity-audit rules are in scope, is the business preparing for the phased deadlines with independent evidence rather than management assurances alone.

That last point matters because California’s current rules are moving the privacy conversation away from generic promises and toward documented, testable controls.

A short 2026 review sequence

If I were running a ccpa audit checklist this week, I would use this order:

1. confirm scope, thresholds, systems, and data categories;
2. compare live data flows against the policy and notices;
3. test every request channel and response deadline;
4. test opt-out, GPC, and cross-property account behavior;
5. inspect vendor contracts and downstream execution paths;
6. review sensitive-data uses and limit-right handling;
7. gather the evidence pack: logs, metrics, training, risk assessments, and cyber-audit readiness.

That sequence surfaces real California exposure much faster than a one-time legal memo or a checkbox spreadsheet.

Bottom line

The best ccpa audit checklist in 2026 is not a document you complete once and archive.

It is a live operating review that checks whether California rights work on the current stack, whether disclosures match what the business is actually doing, whether vendors can carry out the same promises, and whether the company can prove all of that after a regulator asks.

If your audit cannot answer those questions with evidence, the checklist is not finished yet.

Sources

• California Privacy Protection Agency FAQ
• California Privacy Protection Agency, Law & Regulations
• California Privacy Protection Agency, CCPA regulations effective January 1, 2026
• California Privacy Protection Agency, final regulations announcement
• California Department of Justice, CCPA
• California Department of Justice, Privacy Enforcement Actions
• California DOJ, Disney settlement announcement
• California DOJ, General Motors settlement announcement

—

Published: October 16, 2026. Updated using current official California regulator and government materials available at publication time.