When the California Consumer Privacy Act (CCPA) came into effect on January 1, 2020, the United States still had no federal privacy law. California decided not to wait and passed the most comprehensive data protection law in the country, which became the reference for virtually everything that followed.

Two years later, California voters went to the polls and approved Proposition 24, which created the California Privacy Rights Act (CPRA). And this is where things get a little confusing for outsiders.

This guide explains what each one is, what changed, and what the current California law requires from anyone handling data of state consumers.

Good question, and the answer is not simple.

The CCPA (California Consumer Privacy Act) is the original law. It was passed as AB 375 in 2018 and came into effect on January 1, 2020. It is codified at California Civil Code § 1798.100 to § 1798.199.100.

The CPRA (California Privacy Rights Act) is Proposition 24, passed by popular vote on November 3, 2020, with most provisions operative starting January 1, 2023. The CPRA did not create a separate law. It amended and expanded the CCPA. In other words: what exists today is the CCPA with the CPRA amendments incorporated.

The 2020 CCPA guaranteed California consumers basic rights: knowing what was collected, requesting deletion of their data, and refusing the sale of their data. It was a pioneering and important law, but with significant gaps.

The CPRA made deep changes:

Created the California Privacy Protection Agency (CPPA): an independent regulatory agency with full administrative power to implement and enforce the law. Before, it was the Attorney General who enforced compliance. Now the CPPA has its own structure, investigative powers, authority to impose administrative fines, and a guaranteed budget.

Added new rights: the right to correct inaccurate data and the right to limit the use and disclosure of sensitive personal information.

Created the "sharing" category: separated "sale" from "sharing" for cross-context behavioral advertising. This means sharing data with advertising platforms for targeting, even without receiving money directly, now requires an opt-out.

Expanded the definition of sensitive data: added genetic data, neural data, health information, sexual orientation, and sex life.

Required the "Limit the Use of My Sensitive Personal Information" link: in addition to the existing "Do Not Sell or Share My Personal Information."

Imposed data minimization and proportionate retention requirements.

In the California articles on this blog, we cover the current law: CCPA as amended by the CPRA. For the specific CPRA changes, we have a dedicated guide on the California CPRA.

The California Consumer Privacy Act, as amended by the CPRA, is the most comprehensive data protection law in the United States. It guarantees broad rights to California consumers and creates detailed obligations for businesses that handle their data.

Enforcement today is shared between the California Privacy Protection Agency (CPPA) and the California Attorney General, with distinct and complementary powers.

The original CCPA came into effect on January 1, 2020.

The CPRA amendments became operative on January 1, 2023.

The current version of the law, with all rights and obligations in effect, has applied since January 2023.

Under § 1798.140(d), the law applies to for-profit businesses that do business in California, collect personal information from consumers, and meet at least one of the following thresholds:

Annual gross revenues in excess of US$ 25 million in the preceding calendar year.

Annually buys, sells, or shares the personal information of 100,000 or more consumers or households.

Derives 50% or more of annual revenues from selling or sharing consumers' personal information.

The US$ 25 million threshold is the lowest among all US state privacy laws, making the CCPA the law with the broadest reach in terms of businesses affected.

Understanding the distinction between controller and processor is fundamental to defining responsibilities in the processing chain.

Exempt from most obligations:

Protected health information under HIPAA and data of covered entities.

Data regulated by the California Confidentiality of Medical Information Act.

Consumer credit information regulated by the Fair Credit Reporting Act.

Financial data regulated by the Gramm-Leach-Bliley Act or the California Financial Information Privacy Act.

Data regulated by the Driver's Privacy Protection Act.

Academic or public health research data with appropriate safeguards.

Employee and job applicant data when used in that capacity.

Under § 1798.140(v), personal information is any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.

This includes identifiers such as name, address, IP address, email, Social Security number, driver's license, and passport number. It also includes commercial information, browsing history, geolocation data, audio and visual information, employment data, education data, and inferences drawn to create consumer profiles.

De-identified data and publicly available information are excluded.

The CCPA, after CPRA amendments, has an expanded category of "sensitive personal information" (§ 1798.140(ae)):

Social Security number, driver's license, state identification card, or passport number.

Account login, financial account, debit or credit card number in combination with any required security code or password.

Precise geolocation (radius of 1,850 feet or less).

Racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, or union membership.

Contents of a consumer's mail, email, and text messages, unless the business is the intended recipient.

Genetic data.

Neural data: information generated by measuring the activity of a consumer's central or peripheral nervous system.

Processing of biometric information for unique identification.

Health information collected and analyzed.

Information about sex life or sexual orientation.

The inclusion of neural data is exclusive to the CCPA/CPRA among US state privacy laws.

The law guarantees seven main rights:

Right to know and access: confirming whether the business processes their data and obtaining specific information collected, including categories of data, sources, purposes, third parties, and the specific pieces of personal information. The request covers the preceding 12 months (§ 1798.110, 1798.115).

Right to deletion: requesting deletion of personal data collected by the business, with the obligation to notify service providers, contractors, and third parties to also delete (§ 1798.105).

Right to correction: requesting correction of inaccurate personal data, added by the CPRA (§ 1798.106).

Right to opt-out of sale and sharing: directing the business not to sell or share personal data, exercisable at any time (§ 1798.120).

Right to limit use of sensitive personal information: restricting use of sensitive personal information to what is necessary to provide the products or services reasonably expected. Added by the CPRA (§ 1798.121).

Right of non-discrimination: exercising any right without being discriminated against by the business (§ 1798.125).

Private right of action for security breaches: filing a civil lawsuit for damages of US$ 100 to US$ 750 per consumer per incident. Unique among US state privacy laws (§ 1798.150).

The business has 45 days to respond. The deadline can be extended by another 45 days when reasonably necessary, with notification within the initial period. Service is free. The business is not obligated to provide information to the same consumer more than twice in a 12-month period (§ 1798.130(b)).

The CCPA/CPRA requires specific links on the business's homepage (§ 1798.135):

"Do Not Sell or Share My Personal Information": a clear and conspicuous link to a page where the consumer can opt out of sale and sharing of their data.

"Limit the Use of My Sensitive Personal Information": a link allowing the consumer to limit the use of sensitive personal information to what is necessary to provide the products or services.

The business may use a single combined link for both purposes, as long as it clearly allows exercising both options.

Both links need somewhere to land. In practice that destination is a privacy portal where the consumer submits and tracks the request — the same channel that receives access, deletion, and correction requests within the statutory deadline.

It is also possible to comply by honoring the opt-out preference signal of the Global Privacy Control (GPC) when sent by the user.

This distinction created by the CPRA is fundamental.

Sale (§ 1798.140(ad)): transfer of data for monetary or other valuable consideration to third parties.

Sharing (§ 1798.140(ah)): transfer of data to third parties for cross-context behavioral advertising, whether or not for monetary consideration.

Cross-context behavioral advertising (§ 1798.140(k)): targeting ads based on personal information obtained from consumer activity across businesses, distinctly branded websites, applications, or services other than where the consumer is currently interacting.

In practice: if your site passes data to an advertising platform so it can display personalized ads to the user on other sites, that is "sharing" under the CCPA/CPRA, even if you receive no money directly.

Cookies that collect personal information or allow user identification fall directly within the scope of the CCPA/CPRA.

Before firing any non-essential cookie, the site must display a clear cookie notice, offer opt-out of sale and sharing, block non-consented trackers, and honor the GPC.

Correct tag categorization is what makes it possible to identify which cookies constitute sale or sharing and which require the opt-out links.

That same inventory is what you publish to visitors: a CCPA cookie policy needs to list each category of tracker, its purpose, its retention period, and whether it results in sale or sharing of personal information.

§ 1798.120(c) prohibits the sale or sharing of data of consumers under 16 without affirmative authorization:

For consumers between 13 and 15: the consumer's own authorization.

For consumers under 13: authorization from a parent or legal guardian.

A business that willfully disregards the consumer's age is deemed to have actual knowledge of it.

The CPPA (§ 1798.199.10) is governed by a five-member board with terms of up to eight years. It has power to:

Impose administrative fines of up to US$ 2,500 per violation and up to US$ 7,500 for intentional violations or violations involving minors.

Investigate businesses on its own initiative or based on complaints.

Conduct audits.

Issue and revoke regulations.

The Attorney General retains power to seek civil penalties of up to US$ 2,500 per violation and US$ 7,500 for intentional violations or violations involving minors.

There is no guaranteed cure period before CPPA actions. The agency has discretion to investigate and act without any obligation to grant advance notice.

§ 1798.130(a)(1) requires two or more designated methods for submitting requests. One of those methods must be, at minimum, a toll-free telephone number.

Businesses that operate exclusively online with a direct consumer relationship may limit themselves to an email address.

§ 1798.130(a)(5) requires the business to update the privacy notice at least once every 12 months, including lists of the categories of data collected, sold, shared, and disclosed for business purposes in the preceding 12 months.

This is the annual review that keeps a CCPA privacy policy valid — an outdated notice is, in practice, a notice out of compliance.

AdOpt records every consent and opt-out interaction, honors the GPC when sent by the user, blocks trackers before acceptance, and generates the auditable log needed in a CPPA or Attorney General investigation.

The automatic scan identifies all active trackers on the site, feeding the data inventory. And when the law changes, the platform updates automatically.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

Ready to bring your website into compliance with the CCPA? Talk to our team.

To understand how these privacy laws compare in structure and practical impact, our comparative guide goes deeper.

The CCPA is the starting point, not the whole picture. To see what changed when Proposition 24 took effect, read our guide to the CPRA and cookies. And to compare California's approach with the European and Brazilian models, see how the GDPR, LGPD, and CCPA differ in practice.

Compliance with the CCPA rests on three documents that have to agree with each other: the cookies policy, which declares every tracker and its purpose; the privacy policy, which explains what you do with the data; and the privacy portal, where the consumer exercises their rights and you keep the record of it.

1. What is the difference between the CCPA and the CPRA?
The CCPA is California's original privacy law, in effect since January 1, 2020. The CPRA (Proposition 24) was passed by voters in November 2020 and amended the CCPA with full effect from January 2023. The CPRA is not a separate law: it modified and expanded the CCPA. The most important changes were the creation of the California Privacy Protection Agency (CPPA), the addition of rights to correct data and limit use of sensitive personal information, the separation of "sale" from "sharing," and the expanded definition of sensitive personal information.

2. Who needs to comply with the CCPA?
For-profit businesses that do business in California and meet at least one threshold: annual revenues exceeding US$ 25 million; buying, selling, or sharing personal information of 100,000 or more consumers or households per year; or deriving 50% or more of annual revenues from selling or sharing personal data (§ 1798.140(d)).

3. What is the difference between "sale" and "sharing" under the CCPA/CPRA?
"Sale" is the transfer of data for monetary or other valuable consideration to third parties. "Sharing" is the transfer for cross-context behavioral advertising, with or without monetary consideration. The distinction ensures that advertising targeting practices are also subject to opt-out, even without direct payment to the site.

4. What are the "Do Not Sell or Share" and "Limit the Use of My Sensitive Personal Information" links?
These are mandatory links on the business's homepage (§ 1798.135). The first allows the consumer to opt out of sale and sharing of their data. The second allows limiting the use of sensitive personal information. They can be two separate links or a single combined link that clearly allows exercising both options.

5. What is the private right of action under the CCPA and why is it unique?
§ 1798.150 grants consumers the right to file a civil lawsuit when unencrypted and unredacted data is exposed in a security breach due to the business's failure to implement reasonable security measures. The consumer can recover US$ 100 to US$ 750 per incident or actual damages when greater. This private right of action is exclusive to the CCPA among US state privacy laws.

Ready to bring your website into compliance with the CCPA? Talk to our team.