CCPA compliance: 7 steps contact centers must take in 2026

Which businesses fall under the law and why contact centers are exposed

The CCPA, as amended by the California Privacy Rights Act (CPRA), is California's data privacy law governing how businesses collect, use, and share the personal information of California residents. The California Privacy Protection Agency (CPPA) enforces it.

The CCPA applies to any for-profit business that meets at least one of three thresholds.

• Annual gross revenue exceeding $25 million: The business generates more than $25 million in annual gross revenue.
• Data volume reaching 100,000 California residents or households: The business buys, sells, or shares the personal information of 100,000 or more California residents or households annually.
• Revenue derived 50% or more from selling or sharing personal information: The business earns half or more of its annual revenue from selling or sharing California residents' personal information.

What counts as personal information under the CCPA is broad: any information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, to a customer or household. For contact centers, personal information includes call recordings, voiceprints, Customer Relationship Management (CRM) data, IP addresses, account numbers, and AI-generated inferences about callers.

CCPA penalty exposure scales with the number of violations and the number of affected records. Fines reach $2,663 per unintentional violation and $7,988 per intentional violation or any violation involving a minor's data. Customers also have a private right of action for certain data breaches, with statutory damages ranging from $107 to $799 per customer per incident. A contact center processing millions of California interactions annually faces penalty exposure that compounds with every call, recording, and inference generated by its AI systems.

Customer privacy rights contact centers must honor

CCPA grants California residents six rights over their personal information, and contact centers must be prepared to fulfill each one during live interactions.

• Right to know: California residents can request what personal information a business has collected about them and why. Contact centers need a process to provide this information during a call.
• Right to delete: California residents can request deletion of their personal information. In a contact center, this requires deletion propagation across CRM records, call recording archives, AI training datasets, and third-party service providers.
• Right to opt out of sale or sharing: California residents can direct a business to stop selling or sharing their personal information. Contact centers should account for how callers can exercise this right during a phone interaction, not only through a website toggle.
• Right to correct: California residents can request correction of inaccurate personal information. Contact center workflows must route correction requests to the systems where that data lives, including downstream analytics platforms.
• Right to limit use of sensitive personal information: California residents can restrict how a business uses sensitive data, such as financial account numbers, health information, or biometric identifiers, which regularly flow through contact center interactions.
• Right to non-discrimination: Businesses cannot penalize customers for exercising any of these rights. Longer hold times, degraded service quality, or restricted account access after a privacy request creates compliance risk.

What changed for contact centers on January 1, 2026

The 2026 CCPA updates expanded compliance expectations beyond notice-and-response workflows. The updates added documentation, governance, and deadline-driven requirements that matter to enterprise contact centers.

• Cybersecurity audits: Companies with annual gross revenue exceeding $100 million must submit their first cybersecurity audit certification no later than April 1, 2028. Contact center infrastructure falls within audit scope: Contact Center as a Service (CCaaS) platforms, call recording storage, CRM integrations, and AI vendor connections all require documentation.
• Privacy risk assessments: Businesses must produce documentation that addresses whether the personal information processed by their AI systems is sufficiently broad to cover the range of real-world inputs those systems encounter, and how errors from data entry, machine processing, or other sources are measured and mitigated.
• Automated decision-making technology (ADMT) rules: Businesses using ADMT for significant decisions must prepare for pre-use notices, opt-out rights, and access requests that include meaningful information about the logic and likely outcomes of automated processing. ADMT-specific compliance requirements phase in on January 1, 2027.

How AI in contact centers creates new CCPA exposure

The California Attorney General's legal advisory on AI establishes that AI-generated inferences about customers constitute personal information under the CCPA. Every contact center running sentiment analysis, churn prediction, or intent detection is generating personal information with every call, subject to the rights granted by law.

The CPPA defines ADMT as technology that processes personal information and uses computation to replace or substantially replace human decision-making, including machine-learning-derived software. Several AI tools already standard in enterprise contact centers meet the CPPA's ADMT definition.

• Call routing algorithms: Systems that prioritize, deprioritize, or segment callers based on inferred intent, predicted value, or churn risk replace human routing decisions and can trigger notice and opt-out obligations.
• Sentiment scoring: Real-time sentiment analysis that triggers escalation paths or adjusts human agent behavior constitutes automated decisioning about the customer's interaction experience.
• QA automation: AI systems that evaluate human agent performance process both customer voice data and employee performance data simultaneously, potentially triggering ADMT obligations toward both populations.
• Churn prediction for queue prioritization: Models that predict which callers are at risk of leaving and route them to specialized retention queues make significant decisions about the customer experience.
• Voice biometric authentication: Systems that match a caller's voiceprint against stored biometric data to verify identity process sensitive personal information and make access decisions without human involvement.

Seven steps to bring your contact center into CCPA compliance

CCPA compliance requires operational changes across data mapping, vendor contracts, human agent training, and AI governance. Seven operational changes can move a contact center from exposed to governed.

1. Map every data flow that touches California residents

Catalog the personal information collected at each stage of a contact center interaction: IVR input, call recording, CRM lookup, AI inference generation, and post-call analytics. Include data flowing to third-party service providers and AI vendors. A complete data map is the foundation for every subsequent compliance step.

2. Audit AI tools against the ADMT definition

Identify every AI system making or substantially influencing decisions about customers or employees. Document the logic, inputs, and likely outcomes for each system to prepare for ADMT access requests and pre-use notice requirements. This audit determines which tools trigger the strictest disclosure and opt-out obligations.

3. Design a voice-channel ADMT notice and opt-out mechanism

Determine how pre-use notices will be delivered during phone interactions and how opt-out requests will be captured, recorded, and propagated across your vendor stack within the 15-business-day window. Options include IVR disclosures, post-call SMS confirmations, or pre-enrollment web notices. Whichever path you choose, the mechanism must be auditable and consistently applied.

4. Update vendor and service provider contracts

Ensure Data Processing Agreements with CCaaS platforms and AI vendors include explicit ADMT opt-out cascade obligations, deletion propagation requirements, and cybersecurity audit cooperation clauses. Contract gaps with a single downstream vendor can break the entire compliance chain. Review and renegotiate any agreements signed before the 2026 updates.

5. Train human agents on customer rights fulfillment

Human agents must recognize and fulfill privacy rights requests during live calls without requiring the caller to submit a separate written request or navigate to a website. Script updates and workflow changes need to reflect every right granted by the CCPA. Ongoing refresher training keeps frontline teams current as regulations continue to evolve.

6. Prepare privacy risk assessment documentation

Document the data inputs, error measurement methods, and scope of personal information processed by each AI tool in the contact center. This documentation must address whether training data is sufficiently broad and how processing errors are detected and limited. Treat it as a living record that updates with every model change or vendor swap.

7. Build an incident response plan that accounts for per-violation exposure

A data breach affecting contact center call recordings or AI training datasets produces penalty exposure that scales with the number of affected records. Your incident response plan must include workflows for rapid containment, regulatory notification, and customer communication. Tabletop exercises help validate that the plan works under pressure.

Build CCPA compliance into contact center operations

The 2026 CCPA updates and the January 2027 ADMT deadline mean privacy compliance now functions as a contact center architecture requirement. It touches every AI tool, every vendor contract, and every voice interaction with a California resident.

FAQs about CCPA compliance

What is the CCPA?

The California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), is California's data privacy law granting residents rights over their personal information. It is enforced by the California Privacy Protection Agency (CPPA) and applies to for-profit businesses meeting specific revenue, data volume, or revenue-source thresholds.

Does the CCPA apply to contact centers?

A contact center operated by a business that meets CCPA applicability thresholds may be subject to the business's CCPA compliance obligations when it collects or handles customers' personal information.