California Consumer Privacy Act, as amended by the CPRA
The first comprehensive consumer privacy law in the United States, giving California residents rights to know, delete, correct and opt out of the sale or sharing of their personal information. The CPRA created a dedicated enforcement agency, the CPPA.
Who it applies to
- For-profit businesses meeting revenue or data-volume thresholds
- Businesses that buy, sell or share Californians' personal information
- Data brokers, who face additional registration duties
Key requirements
- Clear notice of data collection and purposes at or before collection
- Mechanisms for consumers to know, delete, correct and opt out
- Honouring the Global Privacy Control opt-out signal
- Risk assessments and cybersecurity audits for higher-risk processing
- Data broker registration with the CPPA
Maximum penaltyCivil penalties up to $7,500 per intentional violation, plus a private right of action for certain breaches
Official resources
Praeferre's summary is a starting point, not legal advice. For the authoritative text and current guidance, go directly to the governing body.
Questions we get asked
The CCPA applies to: For-profit businesses meeting revenue or data-volume thresholds; Businesses that buy, sell or share Californians' personal information; Data brokers, who face additional registration duties.
The core obligations are: Clear notice of data collection and purposes at or before collection; Mechanisms for consumers to know, delete, correct and opt out; Honouring the Global Privacy Control opt-out signal; Risk assessments and cybersecurity audits for higher-risk processing; Data broker registration with the CPPA. Each is summarised in plain English above, with a link to the official text.
Effective: 1 January 2020 (CCPA); CPRA amendments effective 1 January 2023. Regulator: California Privacy Protection Agency (CPPA).
Civil penalties up to $7,500 per intentional violation, plus a private right of action for certain breaches.
Praeferre's GRC Automation engine monitors the policies, document repositories and web pages that carry your risk under the CCPA, on a cadence you set, and turns every scan into an audit trail you can put in front of an auditor or regulator.
See how Praeferre automates CCPA / CPRA compliance
Continuous monitoring, evidence and reporting for CCPA / CPRA — alongside every other framework you need to satisfy.