California was the first US state to have a comprehensive data privacy law. And when it decided it could do better, it did.

The California Privacy Rights Act (CPRA), also known as Proposition 24, was approved by California voters in November 2020 and took effect on January 1, 2023. It did not replace the CCPA. It expanded it, strengthened it, and created an independent regulatory agency to enforce it.

If you already dealt with the CCPA and its cookie obligations, you will recognize the structure. But you will need to update everything.

To understand the CPRA, you need to understand California's data privacy trajectory.

2018: The California Consumer Privacy Act (CCPA) is signed by Governor Jerry Brown after more than 629,000 Californians sign petitions to put it on the ballot. The legislature approves a negotiated version before the deadline to avoid the more restrictive version that would have gone to voters.

January 1, 2020: The CCPA takes effect. For the first time, California consumers gain rights to access, deletion, and opt-out of data sales.

July 2020: CCPA enforcement begins by the California Attorney General's office.

November 2020: Voters approve Proposition 24, the CPRA, with 56.2% in favor. Because it was passed by ballot initiative, the state legislature cannot repeal it. Any amendment must be "consistent with and further the purpose and intent" of the law.

January 1, 2022: The CPRA begins applying to data collected from this date forward.

January 1, 2023: The CPRA becomes fully operational. The California Privacy Protection Agency (CPPA) takes over enforcement, replacing the Attorney General in that role.

July 1, 2023: Formal enforcement by the CPPA begins for data collected on or after January 1, 2022.

The CPRA is California's current consumer privacy law. It amends and expands the CCPA, adding new rights, a new category of sensitive personal information with specific controls, a prohibition on retaining data beyond what is necessary, and a dedicated regulatory agency.

Enforcement is the responsibility of the California Privacy Protection Agency (CPPA), an independent agency created by the CPRA itself. The Attorney General retains concurrent authority for certain violations.

The CPRA applies to businesses that conduct business in California or collect personal information from California residents and that meet any one of the following criteria:

Have annual gross revenue exceeding US$ 25 million in the preceding calendar year.

Buy, sell, or share personal information of 100,000 or more consumers or households per year.

Derive 50% or more of annual revenue from selling personal information of consumers.

The original CCPA used a threshold of 50,000 consumers or households. The CPRA doubled that number to 100,000, potentially excluding some smaller businesses. But at the same time, it expanded the concept of "selling" to include "sharing" data, which brought many businesses back into scope.

The focus remains on where consumers are, not where the company is based. A website with California traffic at scale may be in scope regardless of where it operates.

Outside the scope:

HIPAA-covered information, when treated in accordance with that federal law.

Gramm-Leach-Bliley Act regulated data, when treated accordingly.

Credit data regulated by the Fair Credit Reporting Act.

Health information under California's Confidentiality of Medical Information Act.

Research data, under specific conditions.

Employee and job applicant information, when used exclusively in that capacity.

Government entity data.

This is the section that matters for anyone already CCPA-compliant who needs to understand what changed.

The CCPA was enforced by the California Attorney General. The CPRA created the California Privacy Protection Agency (CPPA), an independent agency with an exclusive mission to protect consumer privacy. The CPPA has authority to investigate, fine, and issue regulations. The AG retains concurrent authority for certain violations.

The CCPA had four main rights: access, deletion, opt-out of sale, and non-discrimination. The CPRA added:

Right to correct inaccurate personal information (new).

Right to limit use and disclosure of sensitive personal information (new).

The opt-out right was expanded to include sharing of data for cross-context behavioral advertising, in addition to selling.

The CCPA had no formal category of sensitive data with differentiated treatment. The CPRA created the "sensitive personal information" (SPI) category with its own rules: precise geolocation, financial account data, private communications, genetic data, biometric data, health data, sexual orientation, racial or ethnic origin, religious beliefs, and immigration status. Consumers have the right to limit use of this information to essential purposes.

CCPA: 50,000 consumers or households. CPRA: 100,000 consumers or households. This may have taken some smaller businesses out of scope, but the new concept of "sharing" partially offset that effect.

The CCPA focused on "sale" of data. The CPRA added "sharing," which includes disclosing data for cross-context behavioral advertising even without direct payment. This closed a significant gap: businesses that argued they did not "sell" data but shared it with advertising networks.

The CCPA had no data retention rule. The CPRA explicitly prohibits businesses from retaining personal information beyond what is necessary for the disclosed purpose. Businesses must specify retention periods and comply with them.

The CCPA provided penalties of up to US$ 7,500 per intentional violation. The CPRA kept that amount for general violations but tripled the automatic penalties for violations involving personal information of consumers under 16: up to US$ 7,500 per violation, now applied automatically without needing to prove intent.

The CCPA required opt-in for data of consumers under 16. The CPRA kept that and added: if a consumer under 16 declines consent, the business must wait 12 months before requesting consent again.

The original CCPA had a 30-day cure period: the AG had to notify the business and give 30 days to correct before initiating formal action. The CPRA eliminated that cure period for CPPA enforcement. The CPPA can act directly.

The CPRA requires businesses to conduct periodic privacy risk assessments for high-risk activities, and to submit to regular privacy audits when required by the CPPA.

Any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.

This includes identifiers (name, address, email, IP), legally protected characteristics, commercial information, biometric data, geolocation data, internet activity data, audio and visual data, professional information, education information, and inferences used to create profiles.

Publicly available information from government sources is excluded.

This is the CPRA's major innovation. The law created a subcategory called "sensitive personal information" with specific controls. SPI includes:

Social Security number, driver's license, passport or government ID number.

Financial account, debit or credit card information combined with access credentials.

Precise geolocation.

Contents of private communications (emails, texts), unless the business is the intended recipient.

Genetic data.

Biometric data for unique identification.

Health data.

Information about sex life or sexual orientation.

Racial or ethnic origin, religious or philosophical beliefs, or union membership.

Consumers have the right to limit use and disclosure of SPI to essential purposes.

The CPRA guarantees California residents:

Right to know: categories of personal information collected, sources, purposes, and third parties.

Right to access: a copy of specific personal information collected in the past 12 months.

Right to deletion: request deletion, with some exceptions.

Right to correct: request correction of inaccurate personal information (new under CPRA).

Right to portability: data in a portable, usable format.

Right to opt-out of sale and sharing: refuse sale and sharing for cross-context behavioral advertising.

Right to limit SPI use: limit use and disclosure of sensitive personal information to essential purposes (new under CPRA).

Right to non-discrimination: no penalties for exercising rights.

The response deadline is 45 days, extendable by another 45 days when necessary, with consumer notification within the initial period.

Response is free up to twice per year per consumer.

The CPRA has specific protections for consumers under 16 that deserve attention.

For consumers under 16: the business cannot sell or share personal information without active opt-in. The default is opt-in, not opt-out.

For consumers under 13: consent must be given by parents or legal guardians.

If a consumer under 16 declines consent, the business must wait 12 months before making a new consent request.

Penalties for violations involving data of consumers under 16 are tripled automatically, reaching US$ 7,500 per violation.

The CPRA requires two links that must be visible on the homepage and on any page where personal information is collected:

"Do Not Sell or Share My Personal Information": for opt-out of selling and sharing data for cross-context behavioral advertising.

"Limit the Use of My Sensitive Personal Information": for limiting use of sensitive personal information to essential purposes.

These links may be combined into a single link if both opt-out options are available on the same destination page.

Cookies that collect personal information, especially for behavioral advertising, fall directly within the CPRA's scope.

The site must display a clear cookie notice, provide the opt-out links for sale/sharing and SPI limitation, and block non-necessary trackers before the consumer decides.

Correct tag categorization is what makes it possible to identify which cookies constitute selling or sharing of personal information.

The Global Privacy Control (GPC) is recognized in California: the CPPA confirmed that the GPC is a valid form of opt-out under the CPRA. If a visitor accesses the site with the GPC enabled, that is equivalent to clicking "Do Not Sell or Share My Personal Information."

The CPPA has primary enforcement authority for the CPRA for data collected from January 2022 forward. The AG retains concurrent authority for data breach violations.

There is no guaranteed cure period from the CPPA. The agency can initiate action directly.

Penalties are:

Up to US$ 2,500 per unintentional violation.

Up to US$ 7,500 per intentional violation.

Up to US$ 7,500 per violation involving information of consumers under 16 (automatic, no need to prove intent).

The CPRA also preserves the private right of action for data security violations: consumers can sue the business directly for damages caused by unauthorized data breaches involving specified categories of personal information.

AdOpt records every consent and opt-out interaction, blocks trackers before acceptance, honors the GPC automatically, and generates the auditable log needed in a CPPA investigation.

The automatic scan identifies all active trackers on the site, feeding the data inventory required for the privacy policy and risk assessments. And when the law changes, the platform updates automatically.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

Ready to bring your website into compliance with the California CPRA? Talk to our team.

Compliance in California is built from three documents that need to agree with each other: the cookie policy, which declares every tracker and its purpose; the privacy policy, reviewed at least every 12 months; and the privacy portal, where the consumer exercises their rights and you keep the record of it.

Compliance with the CPRA rests on three documents that have to agree with each other: the cookies policy, which declares every tracker and its purpose; the privacy policy, which explains what you do with the data; and the privacy portal, where the consumer exercises their rights and you keep the record of it.

1. What is the difference between the CCPA and the CPRA? Does the CCPA still exist?
The CCPA still exists as the base law, but the CPRA substantially amended and expanded it. In practice, the current framework is CCPA/CPRA combined, with the CPRA adding new rights (correction, SPI limitation), a new data category (sensitive personal information), a new regulatory body (CPPA), a data retention prohibition, and enforcement changes. The CPRA took effect on January 1, 2023 and applies to data collected on or after January 1, 2022.

2. What is the California Privacy Protection Agency (CPPA) and how does it differ from the Attorney General?
The CPPA is an independent agency created by the CPRA itself, with an exclusive mission to protect consumer privacy in California. It took over CPRA enforcement for data collected from January 2022 forward, replacing the AG in that role. The AG retains concurrent authority for certain data breach violations. The CPPA also has rulemaking authority, which makes California's privacy law more dynamic than other state laws: rules can be updated without going through the legislature.

3. What is sensitive personal information (SPI) and what new rights does it generate?
The CPRA created the sensitive personal information (SPI) category, which includes: precise geolocation, financial account data combined with credentials, private communications, genetic data, biometric data, health data, sex life or sexual orientation, racial or ethnic origin, religious beliefs, and union membership. Consumers have the right to limit use of this information to essential purposes (providing the requested service, security, legal compliance). Businesses must provide a separate "Limit the Use of My Sensitive Personal Information" link on the homepage.

4. What changes for cookies and digital advertising under the CPRA?
The CPRA expanded the concept of "sale" to include "sharing," which covers disclosure of personal information for cross-context behavioral advertising even without direct payment. This means advertising pixels like the Meta Pixel and Google Ads that send behavioral data to external advertising networks may constitute "sharing" under the CPRA, even if the business receives no money directly for that specific sharing. The GPC is recognized as a valid form of opt-out from selling and sharing.

5. What is the penalty for CPRA non-compliance and is there a private right of action?
The CPPA can seek penalties of up to US$ 2,500 per unintentional violation and up to US$ 7,500 per intentional violation. Violations involving data of consumers under 16 generate automatic penalties of up to US$ 7,500 per violation without needing to prove intent. The CPRA preserves the private right of action for data security breaches resulting in unauthorized access to specified categories of personal information. Consumers can sue directly for damages of US$ 100 to US$ 750 per consumer per incident, or actual damages, whichever is greater. Class actions are permitted.

Ready to bring your website into compliance with the California CPRA? Talk to our team.