California Consumer Privacy Act, no retention longer than reasonably necessary for the disclosed purpose (Cal. Civ. Code 1798.100(a)(3))
A business the CCPA covers tells people how long it keeps each kind of personal information, and may not keep it longer than its disclosed purpose reasonably needs. A company that has stopped serving customers has, for most of their data, no purpose left.
Dated 31 Oct 2026Source checked 31 Oct 2026Basis: primary text
Selling a company's data? This is one of the rules a sale has to meet, and the guide beside the button reads it in plain words.
- No data upload
- About two minutes
- No email needed
In the source's own words
“The length of time the business intends to retain each category of personal information, including sensitive personal information, or if that is not possible, the criteria used to determine that period provided that a business shall not retain a consumer's personal information or sensitive personal information for each disclosed purpose for which the personal information was collected for longer than is reasonably necessary for that disclosed purpose.”
Where it was read
Also read from the same source
- California Consumer Privacy Act, definition of sell (Cal. Civ. Code 1798.140(ad)(1))
- California Consumer Privacy Act, no new incompatible purpose without notice (Cal. Civ. Code 1798.100(a)(1), (c))
- California Consumer Privacy Act, voice recordings as biometric information (Cal. Civ. Code 1798.140(c))
- California Consumer Privacy Act, transfer in a merger, acquisition or bankruptcy is not a sale (Cal. Civ. Code 1798.140(ad)(2)(C))
- California Consumer Privacy Act, definition of deidentified (Cal. Civ. Code 1798.140(m))
- California Consumer Privacy Act, definition of service provider (Cal. Civ. Code 1798.140(ag)(1))
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in this guide