California CCPA and CPRA and call recordings

See also

Sources

1. 1
   The 2025 CCPA regulations package (updates, cybersecurity audits, risk assessments, ADMT, insurance) took effect January 1, 2026.

   CCPA Updates, Insurance, Cybersecurity Audits, Risk Assessments, and Automated Decisionmaking Technology (ADMT) Regulations · Key Dates list, effective date · Checked 2026-10-14
2. 2
   The CPPA's CCPA updates, cybersecurity audit, risk assessment, ADMT and insurance regulations were approved by the Office of Administrative Law and filed with the Secretary of State on September 22, 2025, after Board adoption on July 24, 2025.

   CCPA Updates, Insurance, Cybersecurity Audits, Risk Assessments, and Automated Decisionmaking Technology (ADMT) Regulations · Key Dates list · Checked 2026-10-14
3. 3
   The 45-day response period starts on the day the business receives the request regardless of the time needed to verify the consumer, and an unverified request may be denied.

   Cal. Code Regs. Tit. 11, § 7021 - Timelines for Responding to Requests to Delete, Requests to Correct, and Requests to Know · 11 CCR 7021(b) · Checked 2026-10-14
4. 4
   Effective January 1, 2025 CCPA administrative fines and civil penalties are $2,663 per violation, or $7,988 per intentional violation or violation involving consumers under 16.

   California Privacy Protection Agency Announces 2025 Increases for CCPA Fines and Penalties · Adjustment table, rows 1798.155(a) and 1798.199.90(a) · Checked 2026-10-14
5. 5
   Because employees are consumers and the employee exemption has expired, a covered business's call recordings also hold personal information of its California-resident agents, so agents can likely exercise know and delete rights over recordings of their own voice, subject to exceptions.inferred

   Frequently Asked Questions (FAQs) · FAQ: Who has privacy rights under the CCPA?; FAQ on expiry of employee exemption · Checked 2026-10-14
6. 6
   A business must confirm receipt of a request to delete, correct or know within 10 business days, and a request made by phone may be confirmed orally during the call.

   Cal. Code Regs. Tit. 11, § 7021 - Timelines for Responding to Requests to Delete, Requests to Correct, and Requests to Know · 11 CCR 7021(a) · Checked 2026-10-14
7. 7
   The CPPA adjusts CCPA monetary thresholds, fines and damages for California CPI changes every other year, in January of odd-numbered years.

   California Privacy Protection Agency Announces 2025 Increases for CCPA Fines and Penalties · Announcement body, paragraph describing the adjustment cycle · Checked 2026-10-14
8. 8
   The California Privacy Protection Agency enforces the CCPA through administrative enforcement actions.

   Frequently Asked Questions (FAQs) · FAQ: What is the California Privacy Protection Agency? · Checked 2026-10-14
9. 9
   For personal information on archived or backup systems, a business, service provider or contractor may delay deletion until that system is restored to active use or next accessed or used for a sale, disclosure or commercial purpose.

   Cal. Code Regs. Tit. 11, § 7022 - Requests to Delete · 11 CCR 7022(d) · Checked 2026-10-14
10. 10
    When a business denies a deletion request in whole or part it must explain the basis in detail, delete what is not covered by the exception, use retained information only for the exception's purpose and instruct its service providers and contractors likewise.

    Cal. Code Regs. Tit. 11, § 7022 - Requests to Delete · 11 CCR 7022(f)(1)-(4) · Checked 2026-10-14
11. 11
    A business complies with a deletion request by permanently erasing the personal information from its existing systems except archived or backup systems, or by deidentifying or aggregating it.

    Cal. Code Regs. Tit. 11, § 7022 - Requests to Delete · 11 CCR 7022(b)(1) · Checked 2026-10-14
12. 12
    On a deletion request a business must notify its service providers and contractors to delete the consumer's information, or delete it directly where they enable this, and must notify third parties it sold or shared it with unless impossible or disproportionate.

    Cal. Code Regs. Tit. 11, § 7022 - Requests to Delete · 11 CCR 7022(b)(2)-(3) · Checked 2026-10-14
13. 13
    A business may offer deletion of selected categories only if it also offers a single option to delete all personal information, and a business that lets consumers delete specific categories such as voice recordings in other contexts must tell consumers about that option.

    Cal. Code Regs. Tit. 11, § 7022 - Requests to Delete · 11 CCR 7022(h) · Checked 2026-10-14
14. 14
    The CCPA exemptions for employment-related personal information and business-to-business data expired on December 31, 2022.

    Frequently Asked Questions (FAQs) · FAQ: Are the statutory exemptions for employee data and business-to-business transactions still in effect? · Checked 2026-10-14
15. 15
    California residents who are employees or job applicants have CCPA privacy rights.

    Frequently Asked Questions (FAQs) · FAQ: Who has privacy rights under the CCPA? · Checked 2026-10-14
16. 16
    Genesys states the Genesys Cloud GDPR API is not designed for bulk requests such as bulk data deletion.

    Genesys Cloud and GDPR compliance · Exclusions and limitations section · Checked 2026-10-14
17. 17
    Genesys states Genesys Cloud needs no longer than 14 days to delete or anonymize personal data after an erasure request through the GDPR API, and that some services delete while others anonymize without customer choice.

    Genesys Cloud and GDPR compliance · Section on erasure requests and deletion versus anonymization · Checked 2026-10-14
18. 18
    Genesys names its GDPR API as the preferred self-service way for Genesys Cloud customers to respond to CCPA requests to access, rectify or delete personal data.

    Genesys Cloud and CCPA compliance · Opening section on responding to CCPA requests · Checked 2026-10-14
19. 19
    Genesys states that no CCPA certification exists for third-party cloud service providers such as Genesys Cloud.

    Genesys Cloud and CCPA compliance · Section on Genesys Cloud measures and certification · Checked 2026-10-14
20. 20
    Genesys warns that personal data stored in Architect flow names, prompt text-to-speech values or Directory personal status cannot be searched, accessed or removed by Genesys Cloud for privacy requests.

    Genesys Cloud and CCPA compliance · Section on configurations that prevent search or removal · Checked 2026-10-14
21. 21
    In responding to a request to know a business must not disclose unique biometric data (among other identifiers such as SSNs and passwords) but must say with sufficient particularity that it collected that type of information.

    Cal. Code Regs. Tit. 11, § 7024 - Requests to Know · 11 CCR 7024(d) · Checked 2026-10-14
22. 22
    A business need not search for personal information in response to a request to know if it is not kept in a searchable or reasonably accessible format, is kept solely for legal or compliance purposes, is not sold or used commercially, and the business describes the unsearched record categories.

    Cal. Code Regs. Tit. 11, § 7024 - Requests to Know · 11 CCR 7024(c) · Checked 2026-10-14
23. 23
    The default lookback for a request to know is 12 months, but a consumer may request personal information collected on or after January 1, 2022, which the business must provide unless impossible or disproportionate effort, including data held by service providers.

    Cal. Code Regs. Tit. 11, § 7024 - Requests to Know · 11 CCR 7024(h) · Checked 2026-10-14
24. 24
    Sensitive personal information collected or processed without the purpose of inferring characteristics about a consumer is not subject to requests to limit.

    Cal. Code Regs. Tit. 11, § 7027 - Requests to Limit Use and Disclosure of Sensitive Personal Information · 11 CCR 7027(a) and (m)(8) · Checked 2026-10-14
25. 25
    Permitted purposes that do not trigger the right to limit include providing reasonably expected services, security incident handling, fraud resistance, and verifying or maintaining the quality or safety of the business's products and services.

    Cal. Code Regs. Tit. 11, § 7027 - Requests to Limit Use and Disclosure of Sensitive Personal Information · 11 CCR 7027(m)(1)-(3),(7) · Checked 2026-10-14
26. 26
    A business's collection, use, retention and sharing of personal information must be reasonably necessary and proportionate to the purpose for which it was collected or another disclosed compatible purpose.

    Cal. Code Regs. Tit. 11, § 7002 - Restrictions on the Collection and Use of Personal Information · 11 CCR 7002(a) · Checked 2026-10-14
27. 27
    If a consumer submits a request through a method the business has not designated, the business must either treat it as if submitted in the designated manner or tell the consumer how to submit it properly.

    Cal. Code Regs. Tit. 11, § 7020 - Methods for Submitting Requests to Delete, Requests to Correct, and Requests to Know · 11 CCR 7020(e) · Checked 2026-10-14
28. 28
    If a business does not give the notice at collection at or before the point of collection, it may not collect personal information from the consumer.

    Cal. Code Regs. Tit. 11, § 7012 - Notice at Collection of Personal Information · 11 CCR 7012(d) · Checked 2026-10-14
29. 29
    When a business collects personal information over the telephone it may give the CCPA notice at collection orally.

    Cal. Code Regs. Tit. 11, § 7012 - Notice at Collection of Personal Information · 11 CCR 7012(c)(5) · Checked 2026-10-14
30. 30
    The notice at collection must state how long the business intends to retain each category of personal information, or the criteria used to set that period if a length is not possible.

    Cal. Code Regs. Tit. 11, § 7012 - Notice at Collection of Personal Information · 11 CCR 7012(e)(4) · Checked 2026-10-14
31. 31
    The Attorney General's CCPA overview states that statutory damages for a qualifying data breach are up to $750 per incident.disputed

    California Consumer Privacy Act (CCPA) · Data breach private right of action section, damages · Checked 2026-10-14
32. 32
    The California Attorney General's CCPA overview states the revenue threshold for CCPA coverage as gross annual revenue over $25 million.disputed

    California Consumer Privacy Act (CCPA) · Businesses covered by the CCPA, first threshold bullet · Checked 2026-10-14
33. 33
    A business that operates exclusively online and has a direct relationship with the consumer need only provide an email address for requests to know, delete and correct.

    Cal. Code Regs. Tit. 11, § 7020 - Methods for Submitting Requests to Delete, Requests to Correct, and Requests to Know · 11 CCR 7020(a) · Checked 2026-10-14
34. 34
    Requests to opt out of sale or sharing and requests to limit use of sensitive personal information must be honoured as soon as feasible and no later than 15 business days.

    Frequently Asked Questions (FAQs) · FAQ: What is the time frame by which businesses must respond to consumer requests? · Checked 2026-10-14
35. 35
    Breach data that can support a CCPA private action includes a name combined with unique biometric data, where the data was nonencrypted and nonredacted.

    California Consumer Privacy Act (CCPA) · Data breach private right of action section, covered data list · Checked 2026-10-14
36. 36
    The CCPA private right of action is limited to data breaches caused by failure to maintain reasonable security; other CCPA violations can be enforced only by the Attorney General or the California Privacy Protection Agency.

    California Consumer Privacy Act (CCPA) · Data breach private right of action section · Checked 2026-10-14
37. 37
    Effective January 1, 2025 CCPA data-breach statutory damages under Civil Code 1798.150(a)(1)(A) are $107 to $799 per consumer per incident, or actual damages if greater.

    California Privacy Protection Agency Announces 2025 Increases for CCPA Fines and Penalties · Adjustment table, row 1798.150(a)(1)(A) · Checked 2026-10-14
38. 38
    Before bringing a CCPA data-breach claim for statutory damages a consumer must give the business written notice and 30 days to cure.

    California Consumer Privacy Act (CCPA) · Data breach private right of action section, conditions · Checked 2026-10-14
39. 39
    Proposition 24 created the California Privacy Protection Agency, governed by a five-member board, to investigate violations, assess penalties and develop regulations.

    Proposition 24: Amends Consumer Privacy Laws. Initiative Statute. · California Privacy Protection Agency section · Checked 2026-10-14
40. 40
    Proposition 24 removed the ability of businesses to avoid CCPA penalties by curing violations within 30 days of being notified.

    Proposition 24: Amends Consumer Privacy Laws. Initiative Statute. · Enforcement and penalty changes section · Checked 2026-10-14
41. 41
    Most of Proposition 24 (the CPRA) was to take effect in January 2023, while creation of the new privacy agency and its rulemaking duty took effect immediately.

    Proposition 24: Amends Consumer Privacy Laws. Initiative Statute. · Effective dates discussion · Checked 2026-10-14
42. 42
    A business must keep records of consumer requests and its responses for at least 24 months, and need not retain personal information solely to fulfil a consumer request.

    Cal. Code Regs. Tit. 11, § 7101 - Record-Keeping · 11 CCR 7101(a) and (e) · Checked 2026-10-14
43. 43
    A business must respond to a request to delete, correct or know within 45 calendar days of receipt, extendable by up to another 45 days (90 total) with notice and an explanation to the consumer.

    Cal. Code Regs. Tit. 11, § 7021 - Timelines for Responding to Requests to Delete, Requests to Correct, and Requests to Know · 11 CCR 7021(b) · Checked 2026-10-14
44. 44
    Under the CCPA a consumer may ask a business to correct inaccurate personal information about them.

    California Consumer Privacy Act (CCPA) · Rights section: right to correct · Checked 2026-10-14
45. 45
    Under the CCPA a consumer may request that a business delete their personal information and that the business's service providers delete it too, subject to exceptions.

    California Consumer Privacy Act (CCPA) · Rights section: right to delete · Checked 2026-10-14
46. 46
    Under the CCPA a consumer may request the categories and the specific pieces of personal information a business has collected about them, along with sources, purposes and third parties.

    California Consumer Privacy Act (CCPA) · Rights section: right to know · Checked 2026-10-14
47. 47
    Under the CCPA a consumer may limit a business's use of their sensitive personal information to limited purposes.

    California Consumer Privacy Act (CCPA) · Rights section: right to limit · Checked 2026-10-14
48. 48
    For each purpose a business must consider the minimum personal information needed, possible negative impacts on consumers, and additional safeguards such as encryption or automatic deletion.

    Cal. Code Regs. Tit. 11, § 7002 - Restrictions on the Collection and Use of Personal Information · 11 CCR 7002(d)(1)-(3) · Checked 2026-10-14
49. 49
    A CCPA service provider or contractor contract must require the provider to enable the business to comply with consumer requests, or the business must pass along the requests and information needed to fulfil them.

    Cal. Code Regs. Tit. 11, § 7051 - Contract Requirements for Service Providers and Contractors · 11 CCR 7051(a)(10) · Checked 2026-10-14
50. 50
    A service provider or contractor notified of a deletion request must erase, deidentify or aggregate the information and pass the deletion notice to its own subcontractors.

    Cal. Code Regs. Tit. 11, § 7022 - Requests to Delete · 11 CCR 7022(c) · Checked 2026-10-14
51. 51
    The Attorney General's list of CCPA sensitive personal information includes biometric information processed to identify a consumer.

    California Consumer Privacy Act (CCPA) · Sensitive personal information list · Checked 2026-10-14
52. 52
    Because the regulator's sensitive personal information list names mail, email and text message contents but not telephone call contents, a call recording is probably not sensitive personal information merely because it records a conversation, though content within it (for example card numbers or health details) or voiceprints extracted from it may be.inferred

    California Consumer Privacy Act (CCPA) · Sensitive personal information list · Checked 2026-10-14
53. 53
    The Attorney General's list of CCPA sensitive personal information includes the contents of mail, email and text messages.

    California Consumer Privacy Act (CCPA) · Sensitive personal information list · Checked 2026-10-14
54. 54
    A for-profit business doing business in California is covered by the CCPA if it buys, sells or shares the personal information of 100,000 or more California residents or households.

    California Consumer Privacy Act (CCPA) · Businesses covered by the CCPA, threshold list · Checked 2026-10-14
55. 55
    A business that derives 50% or more of its annual revenue from selling (or, per the CPPA FAQ, selling or sharing) California residents' personal information is covered by the CCPA.

    Frequently Asked Questions (FAQs) · FAQ: Who must comply with the CCPA? · Checked 2026-10-14
56. 56
    Effective January 1, 2025 the CPPA raised the CCPA annual gross revenue threshold in Civil Code 1798.140(d)(1)(A) from $25,000,000 to $26,625,000.

    California Privacy Protection Agency Announces 2025 Increases for CCPA Fines and Penalties · Adjustment table, row 1798.140(d)(1)(A) · Checked 2026-10-14
57. 57
    Businesses that are not online-only must offer at least two methods for requests to know, delete and correct, one of which must be a toll-free telephone number.

    Cal. Code Regs. Tit. 11, § 7020 - Methods for Submitting Requests to Delete, Requests to Correct, and Requests to Know · 11 CCR 7020(b) · Checked 2026-10-14
58. 58
    In the Twilio Voice API only recordings with status completed can be deleted, via DELETE on /2010-04-01/Accounts/{AccountSid}/Recordings/{Sid}.json.

    Recordings resource · Delete a Recording section · Checked 2026-10-14
59. 59
    Deleting a Twilio Voice recording sets its status to deleted and the media cannot be recovered.

    Recordings resource · Delete a Recording section · Checked 2026-10-14
60. 60
    After a Twilio Voice recording is deleted its metadata is preserved for 40 days and remains visible in the Console and API.

    Recordings resource · Delete a Recording section; Retrieve a Recording query parameters · Checked 2026-10-14

Documents

Cite this page

WarmTransfer. (2026, October 14). California CCPA and CPRA and call recordings. WarmTransfer. https://warmtransfer.net/knowledge/ccpa-call-recordings

@misc{warmtransfer-ccpa-call-recordings,
  title  = {California CCPA and CPRA and call recordings},
  author = {{WarmTransfer}},
  year   = {2026},
  url    = {https://warmtransfer.net/knowledge/ccpa-call-recordings},
  note   = {Verified 2026-10-14}
}