The California Consumer Privacy Act establishes baseline consumer rights over personal information. The California Privacy Rights Act amends these rules by adding new deletion rights, limiting data sharing, and creating a dedicated enforcement agency to oversee compliance.
The Evolution of California Privacy Law
Imagine you lend a friend a book. You expect them to return it intact. The original privacy law focused on telling the friend your rules. The updated law gives you the power to demand the book back, tear out the pages they copied, and stop them from lending it to others. This shift defines the difference between ccpa and cpra.
The California Consumer Privacy Act (CCPA) created a framework for consumer data rights. It required businesses to disclose what data they collected and allowed consumers to opt out of the sale of that information. The law applied broadly to companies doing business in California. It established a baseline for transparency and consumer control over personal information.
The California Privacy Rights Act (CPRA) amended the CCPA significantly. It expanded the definition of sensitive personal information. It added new consumer rights regarding correction and data sharing. It also created a dedicated regulatory body to enforce compliance. The CPRA did not replace the CCPA entirely; it built upon it. The two laws now operate as a single, unified regulatory regime.
At a Glance: Key Regulatory Shifts
| Aspect | CCPA (Original) | CPRA (Amended) |
|---|---|---|
| Enforcement | Attorney General only | Dedicated Privacy Protection Agency |
| Data Sharing | Opt-out of "sale" only | Opt-out of "sale" and "sharing" |
| Consumer Rights | Access, Delete, Opt-out | Add Correction, Limit Use of Sensitive Data |
| Data Minimisaton | Not explicitly required | Required by law |
| Audit Frequency | Not specified | Annual audits required |
| Response Time | 45 days | 45 days, extendable by 45 |
Understanding the Core Mechanisms
The CCPA focused heavily on the concept of "sale." A sale occurred when a business exchanged personal information for monetary or other valuable consideration. This definition was broad. It included sharing data with third-party advertisers for ad targeting. Consumers could block this sale via a "Do Not Sell My Personal Information" link.
The CPRA narrows this focus. It distinguishes between selling data and sharing data for cross-context behavioural advertising. A business must now offer an opt-out mechanism specifically for sharing data with third parties or service providers. This mechanism often appears as a "Limit the Use of My Sensitive Personal Information" link. This change addresses the gap where data was shared for advertising without a direct monetary transaction.
Service providers and contractors face stricter rules under the CPRA. They can no longer use or retain consumer data for their own purposes. They must delete or return data when the contract ends. This prevents data leakage through the supply chain. Organisations must review their vendor contracts to ensure these restrictions are clearly documented.
Who Must Comply?
The law applies to for-profit entities that do business in California. You meet the threshold if you meet any of three criteria. You have annual gross revenues exceeding a specific amount. You buy, sell, or share the personal information of 100,000 or more consumers or households.
Small businesses and non-profits are generally exempt. Service providers and contractors are exempt if they process data solely on behalf of a covered business. However, the definition of a service provider is strict. If you use the data for your own analytics or product improvement, you may no longer qualify for this exemption. You become a covered business in your own right.
This threshold applies regardless of where your servers are located. If you serve California residents, the law applies. You must map your data flows carefully. You need to know exactly where data comes from, where it goes, and who processes it. This mapping is the foundation of compliance.
What People Usually Get Wrong
Many organisations believe that updating their privacy policy is sufficient. This is incorrect. You must update your technical systems to honour new rights. You need automated processes to locate and delete data. You need mechanisms to verify consumer requests. A policy alone does not demonstrate compliance.
Another common error is confusing "sale" with "sharing." Under the CCPA, sharing data for ad targeting was a sale. Under the CPRA, it is a distinct activity. You must offer separate opt-out mechanisms if your business model involves sharing data with third-party advertisers. Failing to distinguish these activities leaves you exposed to enforcement action.
Organisations often overlook the requirement for data minimisation. You must retain data only as long as necessary. This requires reviewing your retention schedules. You must delete data that no longer serves a legitimate business purpose. This is not just a best practice; it is a legal requirement under the CPRA.
Practical Steps for Compliance
Start by conducting a comprehensive data inventory. You must know what data you hold and why. This inventory should include data sources, categories, and retention periods. Without this map, you cannot respond to consumer requests accurately.
Update your consumer rights processes. You must handle requests to correct, delete, and limit the use of sensitive data. Your verification process must be robust but not burdensome. You must balance security with accessibility. Consumers should be able to exercise their rights easily.
Implement technical controls for opt-outs. Use global privacy controls like browser signals. When a user opts out via their browser, you must honour that signal. This reduces the burden on your support teams. It also improves the user experience.
Handling Sensitive Personal Information
The CPRA introduces a new category: sensitive personal information. This includes precise geolocation, racial origin, health data, and private communications. Consumers have the right to limit the use and disclosure of this data.
You must provide a clear mechanism for this limitation. If a consumer exercises this right, you can only use the data for necessary purposes. These purposes include maintaining security, detecting fraud, or providing services requested by the consumer. You cannot use sensitive data for profiling or targeted advertising if the consumer has opted out.
This requirement impacts how you design your data architecture. You may need to segregate sensitive data from general data. This segregation makes it easier to apply different retention and access controls. It also simplifies your response to consumer requests.
The Role of Third-Party Tools
Organisations often use third-party tools to manage compliance. These tools can help with consent management and request handling. However, no tool can replace your internal processes. You remain responsible for compliance, regardless of the tools you use.
Be cautious with ad tracking technologies. These tools often collect sensitive data. You must ensure they respect consumer opt-outs. Many tracking scripts do not automatically honour global privacy controls. You must configure them correctly.
Consider the impact on cross-border data transfers. If you transfer data outside California, you must ensure adequate protections. The CPRA does not explicitly restrict transfers, but it requires accountability. You must document how you protect data during transfer.
Auditing and Documentation
The CPRA requires annual independent audits. These audits assess your compliance with the law. They focus on your data processing activities and security practices. You must document the results of these audits.
These audits are not just for show. They demonstrate good faith to regulators. They help you identify gaps in your compliance programme. Regular audits keep your programme current. They adapt to changing business practices and legal requirements.
You should also conduct regular training for your staff. Employees need to understand the new rights and procedures. Training reduces the risk of human error. It ensures that everyone in the organisation is aligned with your compliance goals.
Key takeaways
- The CPRA introduces a formal right to correct inaccurate personal data, a capability absent in the original CCPA framework.
- Data minimisation becomes a legal requirement under the CPRA, forcing organisations to retain information only as long as necessary for the stated purpose.
- A new California Privacy Protection Agency now enforces the law, replacing the previous reliance on attorney general actions for regulatory oversight.
The CPRA transforms the CCPA from a passive notice law into an active control framework with strict data minimisation and audit requirements. Conduct an immediate data inventory to map sensitive information flows and update your opt-out mechanisms to reflect the new sharing restrictions.
Frequently asked questions
Does the CPRA apply to small businesses?
Small businesses are generally exempt if they do not meet the revenue, volume, or revenue-source thresholds defined in the law.
How do I verify a consumer's identity?
You must verify the consumer's identity using reliable methods, such as requiring them to log in to an existing account or providing specific personal details.
Can I charge consumers for exercising their rights?
No, you cannot charge consumers for exercising their privacy rights. You may only charge a reasonable fee if the request is excessive or repetitive.
What happens if I fail to comply?
Non-compliance can result in significant civil penalties per violation, plus potential private rights of action for data breaches involving unencrypted information.
How this guide was produced: written by the Breach Observer editorial team with AI assistance, checked against the public references listed below, and reviewed when the facts change. See our editorial policy or report an error.