Privacy & Data Protection · California, United States
California Consumer Privacy Act, as amended by the CPRA
The first comprehensive consumer privacy law in the United States, giving California residents rights to know, delete, correct and opt out of the sale or sharing of their personal information. The CPRA created a dedicated enforcement agency, the CPPA.
REGULATORCalifornia Privacy Protection Agency (CPPA)
REGIONCalifornia, United States
EFFECTIVE1 January 2020 (CCPA); CPRA amendments effective 1 January 2023
Who it applies to
- For-profit businesses meeting revenue or data-volume thresholds
- Businesses that buy, sell or share Californians' personal information
- Data brokers, who face additional registration duties
Key requirements
- Clear notice of data collection and purposes at or before collection
- Mechanisms for consumers to know, delete, correct and opt out
- Honouring the Global Privacy Control opt-out signal
- Risk assessments and cybersecurity audits for higher-risk processing
- Data broker registration with the CPPA
Maximum penaltyCivil penalties up to $7,500 per intentional violation, plus a private right of action for certain breaches
Go to the source
Official resources
Praeferre's summary is a starting point, not legal advice. For the authoritative text and current guidance, go directly to the governing body.
Start your compliance journey
See how Praeferre automates CCPA / CPRA compliance
Continuous monitoring, evidence and reporting for CCPA / CPRA — alongside every other framework you need to satisfy.