What is the CPRA?

CPRA vs CCPA: one law, marked up

The California Privacy Rights Act of 2020 is not a second privacy law sitting beside the CCPA. It is Proposition 24, a ballot measure California voters passed in November 2020, and almost all of it is edits to the CCPA’s own sections: words struck, words inserted, whole sections added. The edited law became operative on 1 January 2023 and, apart from the right of access, applies to personal information collected on or after 1 January 2022. So “CPRA vs CCPA” is a question about versions. The law you comply with today is the CCPA as the CPRA amended it, plus the agency’s regulations.

The revenue figure has moved since: it is CPI-adjusted, and $26,625,000 has applied from 1 January 2025. Who is covered, and the rights every Californian already had under the 2018 law, are in what the CCPA is. This page stays with what the amendment added.

The dates that matter

The amendment arrived in stages. The agency came first, the new rights in 2023, and the heaviest duties are still being phased in. Read the list from the bottom if you only care about what is left to do.

• 1 Jan 2020

  The original CCPA becomes operative.§ 1798.198(a)

• Nov 2020

  Voters pass Proposition 24, the California Privacy Rights Act. The sections creating the agency become operative on the act's effective date, not in 2023.Prop. 24, SEC. 31(b)

• 1 Jan 2022

  The look-back line: apart from the right of access, the amended law applies to personal information collected from this date.Prop. 24, SEC. 31(a)

• 2022

  The CPPA takes the regulations over from the Attorney General. The statute gives no fixed date, only a formula (the later of 1 July 2021 or six months after the agency's notice); the CPPA's own rulemaking list labels the transfer package April 2022.§ 1798.185(d); CPPA rulemaking list

• 1 Jan 2023

  The amendments become operative. The exemptions for staff, job applicants and business contacts lapse.§ 1798.145(m), (n)

• 1 Jul 2023

  Civil and administrative enforcement of the new provisions starts, for violations from that date.§ 1798.185(d)

• 7 Mar 2025

  The CPPA Board orders American Honda Motor Co. to change its practices and pay $632,500 (announced 12 March 2025).CPPA decision

• 1 Jan 2026

  The regulations in force today take effect, including risk assessments, cybersecurity audits and ADMT (adopted September 2025).regs, tit. 11

• 1 Jan 2027ahead

  ADMT rules apply to a business already using it for significant decisions. The next CPI adjustment of the dollar amounts.regs § 7200; § 1798.199.95(d)

• 31 Dec 2027ahead

  Risk assessments due for covered processing that began before 2026 and continues.regs § 7155(b)

• 1 Apr 2028ahead

  Risk-assessment information for 2026 and 2027 goes to the agency; the first cybersecurity audit reports are due from the largest businesses.regs §§ 7157, 7121(a)

Three rights the CPRA wrote in

Proposition 24 added two sections of consumer rights outright, § 1798.106 and § 1798.121, and widened a third. All three now run through the same request machinery as the older rights to know and delete.

The right to correct

A consumer can ask a business to correct inaccurate personal information, and the business must use commercially reasonable efforts to do it (§ 1798.106). It sits on the same clock as a request to know or delete: 45 days, extendable once by an additional 45 days with notice. The regulations add three details that matter in practice. The business weighs the totality of the circumstances and may refuse if the data is more likely than not accurate; if it did not create the data and holds no proof of accuracy, the consumer’s word may be enough (§ 7023(b)). A correction must stay corrected, so the next import from a data supplier cannot write the old value back. And service providers and contractors holding the same record must be told to correct it too (§ 7023(c)).

The right to limit sensitive personal information

The CPRA created a category the 2018 law did not have: sensitive personal information. It covers government ID numbers, account log-ins with their passwords, precise geolocation, racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, union membership, the contents of mail, email and texts, genetic data, biometrics used to identify someone, and data on health, sex life or sexual orientation (§ 1798.140(ae)); the current text also lists neural data. A consumer can tell the business to use it only for what is needed to provide the goods or services an average consumer would expect (§ 1798.121(a)).

Two points narrow the work. First, a business that uses sensitive data only within those purposes owes no “Limit the Use of My Sensitive Personal Information” link; the link is for use beyond them. Second, sensitive data collected or processed without the purpose of inferring characteristics about a consumer falls outside § 1798.121 altogether, though it is still personal information for everything else (§ 1798.121(d)). Where the right does apply, a request to limit must be honoured no later than 15 business days from receipt, and one link titled “Your Privacy Choices” or “Your California Privacy Choices” can replace both homepage links.

The right to opt out of sharing

The 2018 opt-out covered selling. The CPRA added “sharing”: making personal information available to a third party for cross-context behavioural advertising, whether or not money changes hands. It reaches ad-tech pixels even where nobody is paid, a case a sale-only opt-out left open to argument. The homepage link became “Do Not Sell or Share My Personal Information”, and the ban on selling the data of consumers known to be under 16 without opt-in now covers sharing too (§ 1798.120(c)). Our guide to the “Do Not Sell or Share” link covers where it goes and what it must lead to.

Rules on how data is handled

The 2018 law was mostly about telling people things and answering their requests. Proposition 24 rewrote § 1798.100 into a set of general duties that bind a business whether or not anyone ever files a request.

Collect what the purpose needs, keep it no longer

This is a data-minimisation rule in all but name, and it pairs with a disclosure: the notice at collection must now say how long each category of personal information is kept, or the criteria for deciding, and no category may be kept longer than the disclosed purpose reasonably needs (§ 1798.100(a)(3)). A retention schedule stops being good housekeeping and becomes something your notice has to state. The data retention policy template gives it a shape.

Consent has a definition, and dark patterns void it

The amended law defines consent as a freely given, specific, informed and unambiguous indication of the consumer’s wishes, for a narrowly defined purpose. Accepting broad terms of use is not consent; nor is hovering over, muting, pausing or closing content; nor is agreement obtained through a dark pattern, which the law defines as an interface designed or manipulated with the substantial effect of subverting or impairing the user’s choice (§ 1798.140(h), (l)). The definition bites wherever the law asks for consent: using sensitive data again for other purposes after a request to limit (§ 1798.121(b)), or asking someone who opted out to opt back in, which the regulations say must wait at least 12 months (§ 7026(k)).

Every data recipient needs contract terms

A business that sells or shares personal information with a third party, or discloses it to a service provider or contractor, must have an agreement with that recipient saying that (§ 1798.100(d)):

1. the information is sold or disclosed only for limited and specified purposes;
2. the recipient must meet the law's obligations and give the same level of privacy protection;
3. the business may take reasonable and appropriate steps to make sure the recipient uses the data consistently with the business's own obligations;
4. the recipient must tell the business if it can no longer meet those obligations;
5. the business may, on notice, take reasonable and appropriate steps to stop and remediate unauthorised use.

The “contractor” is the amended law’s name for a recipient that gets data for a business purpose under a written contract barring it from selling or sharing the data or using it beyond the contracted purposes (§ 1798.140(j)). The practical result: an ad-tech partner with no contract carrying these terms is a finding waiting to happen, which is exactly one of the points in the agency’s Honda decision below. A data processing agreement template covers most of the same ground for GDPR and CCPA at once.

The CPPA: a regulator of its own

Beyond the rights, the CPRA created an institution. It set up the California Privacy Protection Agency, which now also calls itself CalPrivacy, with full administrative power to implement and enforce the CCPA; it also enforces the Delete Act for data brokers and keeps their data broker registry. A five-member board governs it: the Governor appoints the chair and one member, and the Attorney General, the Senate Rules Committee and the Speaker of the Assembly appoint one each.

The Attorney General did not leave. It still brings civil actions in court, with injunctions and civil penalties. What went is the 2018 law’s automatic 30-day cure: a business used to be in violation only if it failed to fix the problem within 30 days of notice. Now the agency may choose to give time to cure, and it may weigh a lack of intent and any fixes made before it got involved (§ 1798.199.45(a)). Treat a cure period as a favour, not a right.

Duties the CPRA left to regulation

Some of the CPRA’s weightiest duties are only one sentence long in the statute. It told the agency to write regulations requiring businesses whose processing presents significant risk to run a cybersecurity audit and submit risk assessments, and to set rules for automated decisionmaking technology, including what a business must explain about the logic involved (§ 1798.185(a)(14)–(15)). Those regulations now exist, and their first deadlines fall in 2027 and 2028.

Note the first row. Selling or sharing personal information is itself a risk-assessment trigger, so a covered business whose only data deal is an ad pixel can still owe one. The audit row works differently: it reaches businesses above the revenue threshold with large data volumes, and businesses whose model is selling or sharing data.

What a risk assessment has to contain

The regulations list the contents of the written report (§ 7152(a)):

1. the purpose, stated specifically: not “to improve our services” or “security purposes”;
2. the categories of personal information, sensitive ones included;
3. how the data is collected, used and disclosed, how long each category is kept, roughly how many consumers it covers, what they are told, and which service providers, contractors or third parties receive it;
4. the benefits, and the negative impacts on consumers' privacy with their sources and causes;
5. the safeguards planned against those impacts;
6. whether the business will go ahead with the processing;
7. who supplied the information, and the date of review and approval by someone with the authority to decide.

Once written, it is reviewed at least once every three years, updated within 45 calendar days of a material change, and kept for as long as the processing continues or five years after completion, whichever is later (§ 7155). Anyone who has run a GDPR DPIA will recognise the shape; the privacy impact assessment template is a place to start, though the California report has its own required fields.

Opt-out signals: the links never replace them

The CPRA also brought browser signals into the statute. Section 1798.135 describes two ways to offer the opt-out: (a) homepage links, or (b) honouring an opt-out preference signal sent by the consumer’s browser or device, and it says a business may elect which subdivision to comply with. Read alone, that sounds like a free choice between a link and a signal. The regulations say it is not.

So the real choice is narrower. Every business that sells or shares must process a qualifying signal as a valid request to opt out for that browser or device. The only thing a frictionless set-up buys is permission to drop the links. The Attorney General names Global Privacy Control as a signal covered businesses must honour. The business must also show on its site whether it processed the signal, and a signal that later disappears is not consent to opt back in. The Global Privacy Control checker shows whether your own browser is sending one.

If your CCPA work predates 2023

A programme built for the 2018 law and only lightly touched since can miss what the CPRA changed underneath it. Here are 9 things to confirm:

1. Requests. The intake form, the privacy policy and the staff script offer correct and limit, not only know, delete and opt out (§ 1798.106(b)).
2. People. Staff, job applicants and business contacts in California are consumers now; their requests go in the same queue.
3. Ad tags. Every pixel that feeds cross-context advertising is treated as sharing: covered by the opt-out link and by signal processing.
4. Sensitive data. Each use of sensitive personal information is either inside § 1798.121(a) or behind a “Limit” link.
5. Notice at collection. It states a retention period, or the criteria, for each category (§ 1798.100(a)(3)).
6. Contracts. Every third party, service provider and contractor signs the five terms of § 1798.100(d).
7. Choice screens. Opting out takes no more steps than opting in, and “yes” is not the bigger button (regs § 7004).
8. Signals. Global Privacy Control is honoured even though the links are posted (regs § 7025(e)).
9. Assessments. Risk assessments are scheduled for selling, sharing and sensitive-data processing, due by 31 December 2027 for activities begun before 2026.

Questions