The California Privacy Rights Act (CPRA) has a set of requirements for the privacy policy that goes further than any other US state law.

This page covers one piece of the picture. For the full scope of the CPRA — who must comply, the thresholds, the consumer rights and the penalties — start with our complete guide to the CPRA and cookies.

It is not just about what the document must contain. It is about two specific links that must be visible on every page of the site. It is about specifying data retention periods. It is about an entirely new category of sensitive data with its own rules.

This article focuses exclusively on what the CPRA requires from the Privacy Policy, based on the official text of the law.

The law uses the term "privacy policy." In California, legal tradition requires this document to be accessible on the homepage and on any page where personal information is collected.

The CPRA significantly expands what the original CCPA required. If your privacy policy was written for the 2020 CCPA, it is likely outdated on several critical points.

The document must list the categories of personal information the business collects (Civil Code § 1798.100).

This includes: identifiers (name, email, IP), legally protected characteristics, commercial information, biometric data, geolocation data, internet activity data, audio or visual data, professional information, education information, and inferences used to create consumer profiles.

This is the CPRA's major innovation. The document must specifically identify whether the business collects sensitive personal information (Civil Code § 1798.121).

SPI includes: precise geolocation, financial account data with credentials, private communications, genetic data, biometric data, health data, sex life or sexual orientation, racial or ethnic origin, religious beliefs, and union membership.

If the business collects SPI, the policy must:

List the categories of SPI collected.

Describe the purposes for which SPI is used.

State whether use is limited to essential purposes or exceeds that.

Explain how the consumer can exercise the right to limit SPI use.

The document must describe the purposes for which categories of personal information are collected and used (Civil Code § 1798.100).

Purposes must be specific. "Improve our services" is not adequate. "Browsing behavior data collected via analytics cookies to identify pages with high abandonment rates and prioritize usability improvements" is the correct level of specificity.

This is a new requirement that the original CCPA did not have and that the CPRA explicitly introduced.

The document must inform how long each category of personal information is retained, or the criteria used to determine that period (Civil Code § 1798.130 a(5)(A)).

The CPRA prohibits retaining personal information beyond what is necessary for the disclosed purposes. This has direct impact on businesses that were simply accumulating data without a cleanup schedule.

The document must describe all rights guaranteed by the CPRA and how consumers can exercise them (Civil Code § 1798.130).

Rights under the CPRA include:

Right to know: categories and specific information collected, sources, purposes, and third parties.

Right to access: a copy of information collected in the past 12 months.

Right to deletion: request deletion, with exceptions.

Right to correct: correction of inaccurate personal information (new under CPRA).

Right to portability: data in a usable format.

Right to opt-out of sale and sharing: refuse sale and sharing for cross-context behavioral advertising.

Right to limit SPI use: limit use of sensitive information to essential purposes (new under CPRA).

Right to non-discrimination: no penalties for exercising rights.

For each right, the policy must describe the submission channel and the response process within 45 days.

The document must identify the categories of personal information disclosed to third parties for business purposes, and the categories of third parties to whom that information was disclosed (Civil Code § 1798.130).

This covers analytics platforms, advertising tools, CRMs, payment processors, and any external service receiving user data.

If the business sells or shares personal information, the policy must identify:

The categories of personal information sold or shared.

The categories of third parties to which information was sold or shared.

Whether the business sells or shares personal information of consumers under 16 (with confirmation that opt-in was obtained, where applicable).

"Sharing" under the CPRA means disclosing personal information for cross-context behavioral advertising even without direct payment. This includes sharing data with advertising networks via pixels, even if the business receives no money for that specific sharing.

Beyond the content of the policy, the CPRA requires two links that must be visible on the homepage and on any page where personal information is collected:

"Do Not Sell or Share My Personal Information": for opt-out of selling and sharing data for cross-context behavioral advertising.

"Limit the Use of My Sensitive Personal Information": for consumers to limit use of sensitive information to essential purposes.

These links may be combined into a single link if both opt-out options are available on the same destination page.

The privacy policy must describe these links and how they work.

The CPRA created a new layer of control for sensitive personal information that did not exist in the CCPA.

The business may use SPI only for essential purposes, unless the consumer has not exercised the limitation right. Essential purposes include: providing the requested service or product, security and integrity, debugging, reasonable internal research, and legal compliance.

If the business uses SPI for purposes beyond those, the policy must make that explicit and the consumer must have the option to limit that additional use.

The retention period for SPI must be specified. And sensitive information cannot be retained beyond what is necessary for the declared purpose.

The CPRA has specific minor protections that must be reflected in the privacy policy.

For consumers under 16: the business cannot sell or share personal information without active opt-in. The policy must describe how this opt-in is obtained.

For consumers under 13: consent must be given by parents or legal guardians. The policy must describe the parental consent process.

If a consumer under 16 declines consent for sale or sharing, the business must wait 12 months before requesting consent again. The policy must mention this rule.

Penalties for violations involving data of consumers under 16 are tripled and automatic. This should motivate special attention to this segment in the policy.

The CPRA expanded "selling" to include "sharing." This directly impacts how the privacy policy describes the use of advertising cookies.

If the site uses Meta Pixel, Google Ads, TikTok Pixel or any pixel that sends behavioral data to external advertising networks, this may constitute "sharing" of personal information under the CPRA, even if the business receives no direct payment for those specific data.

The policy must:

Identify the types of cookies and trackers used.

State whether data is shared with third parties for cross-context behavioral advertising.

Describe how the consumer can opt out of sharing (via the "Do Not Sell or Share" link or the GPC).

The site's cookie notice must align with what is described in the privacy policy.

The CPRA requires businesses to conduct periodic privacy risk assessments for high-risk activities, including processing of SPI, selling and sharing of data, and processing presenting significant risk to consumer rights.

Assessments do not need to be published in the policy, but the policy should state that the business conducts privacy risk assessments for high-risk activities as part of its compliance program.

The CPPA may request these assessments during investigations.

The CPRA prohibits discrimination against consumers who exercise their rights, including denying goods or services, charging different prices, or offering lower quality.

The exception is loyalty, rewards, premium features, or discount programs where the price or quality difference is reasonably related to the value the business derives from the consumer's data, provided the consumer participates voluntarily.

The privacy policy must describe this non-discrimination policy and any applicable exceptions.

AdOpt ensures that what is written in the policy has real correspondence with what actually happens on the site.

The automatic scan identifies all active technologies, feeding the list of data categories and third parties that must appear in the document. The consent management platform ensures that opt-out links work as described, the GPC is honored automatically, and opt-out records are available for audit.

Every interaction is logged. If the CPPA requests evidence, the record is available.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

Want to build a Privacy Policy for your site that complies with the CPRA? Talk to our team.

Visible and accessible link on the homepage and on all pages where personal information is collected.

"Do Not Sell or Share My Personal Information" link visible on homepage (Civil Code § 1798.120).

"Limit the Use of My Sensitive Personal Information" link visible on homepage if SPI is collected (Civil Code § 1798.121).

Categories of personal information collected, with specific description of each category (Civil Code § 1798.100).

Categories of sensitive personal information (SPI) collected, if applicable (Civil Code § 1798.121).

Purposes of processing for each category, without vague descriptions.

Retention periods for each data category, or criteria used to determine retention (Civil Code § 1798.130 a(5)(A)).

All consumer rights listed with submission process and 45-day response deadline.

Free service for up to two requests per consumer per year (Civil Code § 1798.130 a(3)).

Categories of personal information sold or shared and categories of recipient third parties.

Protection for consumers under 16: mandatory opt-in for sale and sharing.

Protection for consumers under 13: parental consent.

12-month waiting rule after minors under 16 decline consent.

Non-discrimination policy for consumers exercising their rights.

Reference to privacy risk assessments for high-risk activities.

1. My privacy policy was written for the CCPA. What are the main updates needed for the CPRA?
The main updates are: add the sensitive personal information (SPI) category with its specific rules; describe the new right to correct data; describe the right to limit SPI use; include retention periods for each data category; update the "selling" section to include "sharing" for cross-context behavioral advertising; add the two mandatory links ("Do Not Sell or Share" and "Limit Use of SPI"); and reference the CPPA as the regulatory agency instead of the Attorney General.

2. What are the "Do Not Sell or Share" and "Limit the Use of My Sensitive Personal Information" links?
These are two links the CPRA requires to be visible on the homepage and on any page where personal information is collected. The first ("Do Not Sell or Share My Personal Information") allows consumers to opt out of selling and sharing personal information for cross-context behavioral advertising. The second ("Limit the Use of My Sensitive Personal Information") allows consumers to restrict use of sensitive personal information to essential purposes. Both links may be combined into a single link if both options are on the same destination page.

3. Why does the CPRA require specifying data retention periods in the privacy policy?
The CPRA introduced an explicit prohibition on retaining personal information beyond what is necessary for the declared purposes. As a result, businesses must know how long they retain each data category and communicate that to consumers. Civil Code § 1798.130 a(5)(A) requires the policy to specify retention periods or criteria used to determine them. This rule closes a gap that existed under the CCPA, where businesses could accumulate data indefinitely.

4. What changes for data of teenagers aged 13 to 15 under the CPRA?
The CCPA already required opt-in for selling data of consumers under 16. The CPRA added a new rule: if a consumer under 16 declines consent for selling or sharing their data, the business must wait 12 months before making a new consent request. This prevents businesses from repeatedly re-presenting the consent request. Penalties for violations involving data of consumers under 16 are tripled and automatic.

5. Does the CPRA have a private right of action? In what situations can consumers sue the business directly?
Yes. The CPRA preserves and expands the private right of action introduced by the CCPA. Consumers can sue the business directly when there is an unauthorized data breach resulting in unauthorized access, theft, disclosure, use, modification, or destruction of unencrypted, unredacted personal information. Categories include Social Security numbers, financial account credentials, debit or credit card data with security codes, medical information, health insurance information, and other categories specified in the law. Minimum damages per consumer per incident are US$ 100 to US$ 750, or actual damages, whichever is greater. Class actions are permitted.

Ready to build a Privacy Policy for your site that complies with the CPRA? Talk to our team.