California SaaS Agreement Review
California sets the toughest baseline in the country for a software buyer. The CCPA, as amended by the CPRA, requires a written contract with every service provider that handles personal information, and the California Privacy Protection Agency now enforces detailed rules on top. The state's breach and automatic renewal statutes were both tightened recently, so a SaaS agreement drafted a few years ago may already be out of date as of 2026.
Consumer privacy law in California
California Consumer Privacy Act (CCPA/CPRA)
Applies at $26,625,000 in annual revenue (the $25m figure as inflation-adjusted from 2025), or 100,000 California consumers or households, or deriving 50% of revenue from selling or sharing personal information.
Data rights in California
California has enacted the California Consumer Privacy Act (CCPA/CPRA), a comprehensive consumer privacy law. It gives residents rights over their personal data, typically access, correction, deletion, and the ability to opt out of the sale of data and targeted advertising, and generally requires vendors to sign a data-processing agreement. When you buy SaaS that will hold data about California residents, the vendor's terms should line up with those obligations.
The clauses that decide your risk
- Data use & AI training, is your data used only to provide the service, or to "improve" (train) the vendor’s models?
- Liability cap, often just one month of fees, against real data-loss exposure
- Auto-renewal, the cancellation-notice window (miss it and you renew for a year)
- Price increases, capped, or unilateral at renewal?
- Data export & deletion on termination, can you get your data out, and is it deleted?
- Uptime SLA and service credits
What must a CCPA service provider contract say?
To count as a service provider rather than a third party, the vendor must be bound by a contract that limits its use of personal information to the business purposes listed, bars selling or sharing the data, and bars combining it with data from other customers except as the regulations allow. Without those terms, a transfer can look like a sale. The CPPA's 2025 regulation package on risk assessments, cybersecurity audits and automated decisionmaking technology was approved in September 2025, with obligations phasing in from 2026.
The law applies to businesses meeting a revenue threshold, originally $25 million and now adjusted for inflation, or handling data of 100,000 or more California consumers or households.
Breach notice and renewals in 2026
Civil Code 1798.82 now requires notice to affected residents within 30 calendar days of discovering a breach, and a sample copy to the Attorney General within 15 days of notifying people when more than 500 Californians are affected. Your vendor's reporting window needs to fit inside that.
California's Automatic Renewal Law, Business and Professions Code 17600 and following, was amended by AB 2863 effective July 1, 2025 to require express consent to renewal terms and easy online cancellation. It protects consumers rather than business buyers.
What must a California breach notice look like?
Civil Code 1798.82 prescribes the format: the title Notice of Data Breach, headings such as What Happened and What You Can Do, and text no smaller than 10 point. A customer injured by a violation can bring a civil action for damages, and the statute cannot be waived by contract. If a vendor drafts notices for you, require that they follow this format.
California sources checked 2026-10-09: California Privacy Protection Agency, regulations · Ashurst Perkins Coie, California breach chart. Laws change; confirm the current rule before relying on it.
California SaaS agreement FAQ
Does California have a data privacy law that affects SaaS contracts?
Yes. California has enacted a comprehensive consumer privacy law, the California Consumer Privacy Act (CCPA/CPRA). It gives residents rights over their personal data (such as access, deletion, and opting out of sale or targeted advertising) and generally requires a data-processing agreement, which shapes what a SaaS vendor can do with data about California residents. Note the scope: Applies at $26,625,000 in annual revenue (the $25m figure as inflation-adjusted from 2025), or 100,000 California consumers or households, or deriving 50% of revenue from selling or sharing personal information.
Can a SaaS vendor use my California business's data to train AI?
Only if the contract lets them. Many SaaS agreements grant the vendor a right to use "customer data" to "improve the services," which can extend to training models. Regardless of California law, insist the contract says your data is never used to train shared or general-purpose models and is processed only to provide the service to you.
What should I check before signing a SaaS agreement in California?
The clauses that decide your risk: how your data can be used (and whether it trains AI), the liability cap versus your data-loss exposure, auto-renewal and the cancellation-notice window, unilateral price increases, and whether you can export and require deletion of your data on termination. ClauseAudit flags each against California law in about a minute.
Can a SaaS vendor use California customer data to train its own models?
Under the CCPA a service provider may use personal information to build or improve the quality of its services, but not to build profiles for other businesses or to sell or share the data. Whether model training fits depends on the contract and the regulations, so state plainly in the agreement whether training on your data is allowed.
Do California breach rules require free credit monitoring?
If the business sending the notice was the source of the breach and Social Security or government ID numbers were exposed, any identity theft prevention offered must be free for at least 12 months. Make sure your SaaS contract says the vendor pays for this when its systems caused the incident.
Reviewing a SaaS contract in California?
Upload it and get the data, liability, and renewal terms checked against California law in about a minute.
State privacy-law status summarized as of October 2026; this area changes quickly and thresholds and effective dates vary. This is automated educational information, not legal advice, ClauseAudit verifies current California law when you run your agreement, and you should confirm anything critical with a qualified attorney.