When the California Consumer Privacy Act (CCPA) came into effect on January 1, 2020, the United States still had no federal privacy law. California decided not to wait and passed the most comprehensive data protection law in the country, which became the reference for virtually everything that followed.

Two years later, California voters went to the polls and approved Proposition 24, which created the California Privacy Rights Act (CPRA). And this is where things get a little confusing for outsiders.

This guide explains what each one is, what changed, and what the current California law requires from anyone handling data of state consumers.

## CCPA and CPRA: the same law or different laws?

Good question, and the answer is not simple.

The **CCPA** (California Consumer Privacy Act) is the original law. It was passed as AB 375 in 2018 and came into effect on January 1, 2020. It is codified at California Civil Code § 1798.100 to § 1798.199.100.

The **CPRA** (California Privacy Rights Act) is Proposition 24, passed by popular vote on November 3, 2020, with most provisions operative starting January 1, 2023. The CPRA did not create a separate law. It **amended and expanded** the CCPA. In other words: what exists today is the CCPA with the CPRA amendments incorporated.

### What the CCPA had originally

The 2020 CCPA guaranteed California consumers basic rights: knowing what was collected, requesting deletion of their data, and refusing the sale of their data. It was a pioneering and important law, but with significant gaps.

### What the CPRA changed starting in 2023

The CPRA made deep changes:

**Created the California Privacy Protection Agency (CPPA):** an independent regulatory agency with full administrative power to implement and enforce the law. Before, it was the Attorney General who enforced compliance. Now the CPPA has its own structure, investigative powers, authority to impose administrative fines, and a guaranteed budget.

**Added new rights:** the right to correct inaccurate data and the right to limit the use and disclosure of sensitive personal information.

**Created the "sharing" category:** separated "sale" from "sharing" for cross-context behavioral advertising. This means sharing data with advertising platforms for targeting, even without receiving money directly, now requires an opt-out.

**Expanded the definition of sensitive data:** added genetic data, neural data, health information, sexual orientation, and sex life.

**Required the "Limit the Use of My Sensitive Personal Information" link:** in addition to the existing "Do Not Sell or Share My Personal Information."

**Imposed data minimization and proportionate retention requirements.**

| Aspect | CCPA (2020) | CCPA + CPRA (2023) |
|---|---|---|
| Enforcement | Attorney General | CPPA (independent agency) + AG |
| Consumer rights | 5 rights | 7 rights |
| Required links | "Do Not Sell My Personal Information" | "Do Not Sell or Share" + "Limit Sensitive PI" |
| Sensitive data | Basic category | Expanded (includes neural data) |
| Private right of action | Security breaches only | Security breaches only |
| Full effect | Jan 2020 | Jan 2023 |

In the California articles on this blog, we cover the current law: **CCPA as amended by the CPRA**. For the specific CPRA changes, we have a dedicated guide on the [California CPRA](https://goadopt.io/en/blog/california-cpra-and-cookies-all-you-need-to-know/).

## What is the CCPA/CPRA today?

The California Consumer Privacy Act, as amended by the CPRA, is the most comprehensive data protection law in the United States. It guarantees broad rights to California consumers and creates detailed obligations for businesses that handle their data.

Enforcement today is shared between the **California Privacy Protection Agency (CPPA)** and the **California Attorney General**, with distinct and complementary powers.

## When did the CCPA come into effect?

The original CCPA came into effect on **January 1, 2020**.

The CPRA amendments became operative on **January 1, 2023**.

The current version of the law, with all rights and obligations in effect, has applied since January 2023.

## Who needs to comply with the CCPA?

Under § 1798.140(d), the law applies to for-profit businesses that do business in California, collect personal information from consumers, and meet at least **one** of the following thresholds:

Annual gross revenues in excess of **US$ 25 million** in the preceding calendar year.

Annually buys, sells, or shares the personal information of **100,000 or more consumers or households**.

Derives **50% or more** of annual revenues from selling or sharing consumers' personal information.

The US$ 25 million threshold is the lowest among all US state privacy laws, making the CCPA the law with the broadest reach in terms of businesses affected.

Understanding the distinction between [controller and processor](https://goadopt.io/en/blog/responsibilities-of-a-data-protection-officer/) is fundamental to defining responsibilities in the processing chain.

### CCPA Exemptions

Exempt from most obligations:

Protected health information under HIPAA and data of covered entities.

Data regulated by the California Confidentiality of Medical Information Act.

Consumer credit information regulated by the Fair Credit Reporting Act.

Financial data regulated by the Gramm-Leach-Bliley Act or the California Financial Information Privacy Act.

Data regulated by the Driver's Privacy Protection Act.

Academic or public health research data with appropriate safeguards.

Employee and job applicant data when used in that capacity.

## What is personal information under the CCPA?

Under § 1798.140(v), personal information is any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.

This includes identifiers such as name, address, IP address, email, Social Security number, driver's license, and passport number. It also includes commercial information, browsing history, geolocation data, audio and visual information, employment data, education data, and inferences drawn to create consumer profiles.

De-identified data and publicly available information are excluded.

## What is sensitive personal information under the CCPA/CPRA?

The CCPA, after CPRA amendments, has an expanded category of "sensitive personal information" (§ 1798.140(ae)):

Social Security number, driver's license, state identification card, or passport number.

Account login, financial account, debit or credit card number in combination with any required security code or password.

Precise geolocation (radius of 1,850 feet or less).

Racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, or union membership.

Contents of a consumer's mail, email, and text messages, unless the business is the intended recipient.

Genetic data.

Neural data: information generated by measuring the activity of a consumer's central or peripheral nervous system.

Processing of biometric information for unique identification.

Health information collected and analyzed.

Information about sex life or sexual orientation.

The inclusion of neural data is exclusive to the CCPA/CPRA among US state privacy laws.

## What are consumer rights under the CCPA/CPRA?

The law guarantees seven main rights:

**Right to know and access:** confirming whether the business processes their data and obtaining specific information collected, including categories of data, sources, purposes, third parties, and the specific pieces of personal information. The request covers the **preceding 12 months** (§ 1798.110, 1798.115).

**Right to deletion:** requesting deletion of personal data collected by the business, with the obligation to notify service providers, contractors, and third parties to also delete (§ 1798.105).

**Right to correction:** requesting correction of inaccurate personal data, added by the CPRA (§ 1798.106).

**Right to opt-out of sale and sharing:** directing the business not to sell or share personal data, exercisable at any time (§ 1798.120).

**Right to limit use of sensitive personal information:** restricting use of sensitive personal information to what is necessary to provide the products or services reasonably expected. Added by the CPRA (§ 1798.121).

**Right of non-discrimination:** exercising any right without being discriminated against by the business (§ 1798.125).

**Private right of action for security breaches:** filing a civil lawsuit for damages of US$ 100 to US$ 750 per consumer per incident. Unique among US state privacy laws (§ 1798.150).

The business has **45 days** to respond. The deadline can be extended by another **45 days** when reasonably necessary, with notification within the initial period. Service is free. The business is not obligated to provide information to the same consumer more than **twice in a 12-month period** (§ 1798.130(b)).

## The two required links on the site

The CCPA/CPRA requires specific links on the business's homepage (§ 1798.135):

**"Do Not Sell or Share My Personal Information":** a clear and conspicuous link to a page where the consumer can opt out of sale and sharing of their data.

**"Limit the Use of My Sensitive Personal Information":** a link allowing the consumer to limit the use of sensitive personal information to what is necessary to provide the products or services.

The business may use a single combined link for both purposes, as long as it clearly allows exercising both options.

Both links need somewhere to land. In practice that destination is a [privacy portal where the consumer submits and tracks the request](https://goadopt.io/en/blog/california-ccpa-dsar-privacy-portal/) — the same channel that receives access, deletion, and correction requests within the statutory deadline.

It is also possible to comply by honoring the opt-out preference signal of the **Global Privacy Control (GPC)** when sent by the user.

## "Sale" vs "sharing" under the CCPA/CPRA

This distinction created by the CPRA is fundamental.

**Sale** (§ 1798.140(ad)): transfer of data for monetary or **other valuable consideration** to third parties.

**Sharing** (§ 1798.140(ah)): transfer of data to third parties for **cross-context behavioral advertising**, whether or not for monetary consideration.

Cross-context behavioral advertising (§ 1798.140(k)): targeting ads based on personal information obtained from consumer activity across businesses, distinctly branded websites, applications, or services other than where the consumer is currently interacting.

In practice: if your site passes data to an advertising platform so it can display personalized ads to the user on other sites, that is "sharing" under the CCPA/CPRA, even if you receive no money directly.

## Cookies and the CCPA/CPRA

Cookies that collect personal information or allow user identification fall directly within the scope of the CCPA/CPRA.

Before firing any non-essential cookie, the site must display a clear [cookie notice](https://goadopt.io/en/blog/operation-of-cookie-banner/), offer opt-out of sale and sharing, block non-consented trackers, and honor the GPC.

[Correct tag categorization](https://goadopt.io/en/blog/difference-cookies-local-storage-session-storage/) is what makes it possible to identify which cookies constitute sale or sharing and which require the opt-out links.

That same inventory is what you publish to visitors: a [CCPA cookie policy](https://goadopt.io/en/blog/california-ccpa-cookies-policy/) needs to list each category of tracker, its purpose, its retention period, and whether it results in sale or sharing of personal information.

## Protection for consumers under 16 years of age

§ 1798.120(c) prohibits the sale or sharing of data of consumers under 16 without affirmative authorization:

For consumers between 13 and 15: the consumer's own authorization.

For consumers under 13: authorization from a parent or legal guardian.

A business that willfully disregards the consumer's age is deemed to have actual knowledge of it.

## The California Privacy Protection Agency (CPPA)

The CPPA (§ 1798.199.10) is governed by a five-member board with terms of up to eight years. It has power to:

Impose administrative fines of up to **US$ 2,500 per violation** and up to **US$ 7,500 for intentional violations** or violations involving minors.

Investigate businesses on its own initiative or based on complaints.

Conduct audits.

Issue and revoke regulations.

The Attorney General retains power to seek **civil penalties** of up to US$ 2,500 per violation and US$ 7,500 for intentional violations or violations involving minors.

There is no guaranteed cure period before CPPA actions. The agency has discretion to investigate and act without any obligation to grant advance notice.

## The toll-free number is mandatory

§ 1798.130(a)(1) requires two or more designated methods for submitting requests. One of those methods must be, at minimum, a **toll-free telephone number**.

Businesses that operate exclusively online with a direct consumer relationship may limit themselves to an email address.

## Privacy notice: update every 12 months

§ 1798.130(a)(5) requires the business to update the privacy notice **at least once every 12 months**, including lists of the categories of data collected, sold, shared, and disclosed for business purposes in the preceding 12 months.

This is the annual review that keeps a [CCPA privacy policy](https://goadopt.io/en/blog/california-ccpa-privacy-policy/) valid — an outdated notice is, in practice, a notice out of compliance.

## How AdOpt helps with the CCPA/CPRA

AdOpt records every consent and opt-out interaction, honors the GPC when sent by the user, blocks trackers before acceptance, and generates the auditable log needed in a CPPA or Attorney General investigation.

The automatic scan identifies all active [trackers](https://goadopt.io/en/blog/gdpr-cookies-explained/) on the site, feeding the data inventory. And when the law changes, the platform updates automatically.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Ready to bring your website into compliance with the CCPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Comparing CCPA/CPRA with other privacy laws

| Law | State | Threshold | Penalty | Enforcer | Effective Date |
|---|---|---|---|---|---|
| CCPA/CPRA | California | US$ 25M OR 100K consumers OR 50% revenue | Up to US$ 7,500/violation | CPPA + AG | Jan 2020/Jan 2023 |
| VCDPA | Virginia | 100K or 25K + 50% revenue | Up to US$ 7,500/violation | AG | Jan 2023 |
| FDBR | Florida | US$ 1B+ global revenue | Up to US$ 50K/violation | Dept. Legal Affairs | Jul 2024 |
| NHDPA | New Hampshire | 35K or 10K + 25% revenue | Up to US$ 10K/violation | AG | Jan 2025 |
| CPA | Colorado | 100K or 25K + 50% revenue | Up to US$ 20K/violation | AG | Jul 2023 |

To understand how these [privacy laws](https://goadopt.io/en/blog/gdpr-lgpd-and-ccpa-what-are-these-laws-similarities-and-differences/) compare in structure and practical impact, our comparative guide goes deeper.

## Continue learning about privacy in California

The CCPA is the starting point, not the whole picture. To see what changed when Proposition 24 took effect, read our guide to the [CPRA and cookies](https://goadopt.io/en/blog/california-cpra-and-cookies-all-you-need-to-know/). And to compare California's approach with the European and Brazilian models, see [how the GDPR, LGPD, and CCPA differ in practice](https://goadopt.io/en/blog/gdpr-lgpd-and-ccpa-what-are-these-laws-similarities-and-differences/).

## The CCPA in practice: the three documents

Compliance with the CCPA rests on three documents that have to agree with each other: the [cookies policy](https://goadopt.io/en/blog/california-ccpa-cookies-policy/), which declares every tracker and its purpose; the [privacy policy](https://goadopt.io/en/blog/california-ccpa-privacy-policy/), which explains what you do with the data; and the [privacy portal](https://goadopt.io/en/blog/california-ccpa-dsar-privacy-portal/), where the consumer exercises their rights and you keep the record of it.

## FAQ: California CCPA/CPRA

**1. What is the difference between the CCPA and the CPRA?**
The CCPA is California's original privacy law, in effect since January 1, 2020. The CPRA (Proposition 24) was passed by voters in November 2020 and amended the CCPA with full effect from January 2023. The CPRA is not a separate law: it modified and expanded the CCPA. The most important changes were the creation of the California Privacy Protection Agency (CPPA), the addition of rights to correct data and limit use of sensitive personal information, the separation of "sale" from "sharing," and the expanded definition of sensitive personal information.

**2. Who needs to comply with the CCPA?**
For-profit businesses that do business in California and meet at least one threshold: annual revenues exceeding US$ 25 million; buying, selling, or sharing personal information of 100,000 or more consumers or households per year; or deriving 50% or more of annual revenues from selling or sharing personal data (§ 1798.140(d)).

**3. What is the difference between "sale" and "sharing" under the CCPA/CPRA?**
"Sale" is the transfer of data for monetary or other valuable consideration to third parties. "Sharing" is the transfer for cross-context behavioral advertising, with or without monetary consideration. The distinction ensures that advertising targeting practices are also subject to opt-out, even without direct payment to the site.

**4. What are the "Do Not Sell or Share" and "Limit the Use of My Sensitive Personal Information" links?**
These are mandatory links on the business's homepage (§ 1798.135). The first allows the consumer to opt out of sale and sharing of their data. The second allows limiting the use of sensitive personal information. They can be two separate links or a single combined link that clearly allows exercising both options.

**5. What is the private right of action under the CCPA and why is it unique?**
§ 1798.150 grants consumers the right to file a civil lawsuit when unencrypted and unredacted data is exposed in a security breach due to the business's failure to implement reasonable security measures. The consumer can recover US$ 100 to US$ 750 per incident or actual damages when greater. This private right of action is exclusive to the CCPA among US state privacy laws.

[Ready to bring your website into compliance with the CCPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)


California CCPA and Cookies: All You Need to Know

João Bruno Soares

The California Privacy Rights Act (CPRA) brought a change that directly affects any site with advertising pixels installed.

This page covers one piece of the picture. For the full scope of the CPRA — who must comply, the thresholds, the consumer rights and the penalties — start with our [complete guide to the CPRA and cookies](https://goadopt.io/en/blog/california-cpra-and-cookies-all-you-need-to-know/).

The CCPA talked about "selling" data. The CPRA added "sharing": the disclosure of personal information for cross-context behavioral advertising across different sites, even if no money changes hands directly.

This means the Meta Pixel on your site may constitute "sharing" of personal information under the CPRA, even if you receive no money for that specific sharing.

This article focuses exclusively on what the CPRA requires from a Cookies Policy: what the document must contain, how opt-out must work, and what changes for each tracker on your site.

## Cookies Policy vs. cookie banner: the necessary distinction

The [cookie banner](https://goadopt.io/en/blog/how-to-choose-a-cookie-banner-for-your-website/) is the consent interface. It is what the visitor sees when they first access the site.

The Cookies Policy is the detailed document. It is where the user finds complete information about each technology: what it collects, what it is for, who receives the data, and how to exercise rights over it.

Both need to exist. Both need to be aligned. And the Cookies Policy must be accessible from a clear link within the [consent notice](https://goadopt.io/en/blog/operation-of-cookie-banner/) itself.

## What the CPRA specifically requires for cookies

### Specific purpose for each tracker category

The CPRA requires businesses to collect personal information only for specific, explicit, and legitimate purposes and not to process data in ways incompatible with those purposes (Civil Code § 1798.100(a)(2)).

For cookies, each category needs a concrete purpose description.

What does not work: "cookies to improve your experience."

What works: "Analytics cookies: collect browsing behavior data including pages visited, traffic source, and session duration, to identify content and experience improvement opportunities. Data is sent to Google Analytics and retained for 14 months."

"Advertising cookies: collect behavioral identifiers sent to Meta and Google for creating advertising audiences and displaying personalized ads on other platforms. This constitutes sharing of personal information under the CPRA. Consumers may refuse this sharing via the 'Do Not Sell or Share My Personal Information' link or by activating the Global Privacy Control."

### Cookie categories present on the site

The Policy must list the tracker categories operating on the site:

**Strictly necessary cookies:** essential for basic functionality. Do not constitute selling or sharing. Must be documented.

**Analytics cookies:** measure browsing behavior. Depending on the tool, may constitute sharing of personal information if data is sent to third parties who use it for advertising on other sites.

**Advertising and sharing cookies:** feed ad pixels, build behavioral profiles for cross-site behavioral advertising. Almost always constitute "sharing" under the CPRA. Require an opt-out link.

**Functional cookies:** remember user preferences. Generally do not constitute selling or sharing.

**Third-party cookies:** fired by external services. [Correct tag categorization](https://goadopt.io/en/blog/best-practices-tag-categorization/) is what makes accurate documentation possible.

### The CPRA distinction between "selling" and "sharing"

This is the most important concept differentiating the CPRA from other laws for cookie purposes.

**Selling** is the exchange of personal information for monetary or other valuable consideration.

**Sharing** is the disclosure of personal information to a third party for cross-context behavioral advertising purposes, regardless of whether there is direct payment (Civil Code § 1798.140(ah)).

In practice, this means that when the Meta Pixel sends visitor behavior data from your site to Meta, that transmission may constitute "sharing" under the CPRA even if the business receives no money specifically for that data. What Meta does with that data to display ads on other platforms is the criterion.

Not a sale or sharing: disclosure to service providers processing data exclusively on behalf of the business, disclosure to provide the product or service requested by the consumer, and M&A transfers.

### Categories of third parties receiving data via cookies

The Policy must identify the categories of third parties to which data is sold or shared via cookies (Civil Code § 1798.130).

This includes digital advertising platforms (Meta, Google, TikTok, Pinterest), programmatic advertising networks, analytics platforms that use data for other purposes, and any other partner receiving behavioral data from site users.

### Retention period for each category

The CPRA introduced the requirement to disclose data retention periods, which the original CCPA did not have (Civil Code § 1798.130 a(5)(A)).

For the Cookies Policy, this means documenting:

How long each cookie remains active on the user's device.

How long data collected via cookies is retained in the business's servers and/or by involved third parties.

When and how data is deleted after the retention period.

### The "Do Not Sell or Share My Personal Information" link

The CPRA requires this link to be visible on the homepage and on any page where personal information is collected (Civil Code § 1798.120(a)).

This link must:

Be clear and conspicuous, not buried in menus.

Lead to a page where the consumer can opt out of selling and sharing.

Not require the consumer to create an account or go through multiple steps to opt out.

The Cookies Policy must identify this link and describe how the opt-out works in practice: which technologies are deactivated when the consumer clicks the link.

### The Global Privacy Control (GPC)

The Global Privacy Control (GPC) is a technical signal that consumers activate in their browser to automatically request opt-out of selling and sharing across all sites visited.

The CPPA (California Privacy Protection Agency) confirmed that the GPC constitutes a valid form of opt-out from selling and sharing under the CPRA. When a visitor accesses the site with the GPC enabled, the site must treat that as if the consumer had clicked "Do Not Sell or Share My Personal Information."

The Cookies Policy must state that the business recognizes and honors the GPC.

### The "Limit the Use of My Sensitive Personal Information" link

If the site collects sensitive personal information via cookies (such as precise geolocation data), the business must provide the "Limit the Use of My Sensitive Personal Information" link (Civil Code § 1798.121(a)).

Precise geolocation is one of the most relevant SPI categories for cookies: any cookie or technology that captures device location with enough precision to identify the user's position within a city block may constitute SPI collection.

If the site collects precise geolocation, the Cookies Policy must:

Identify this collection as SPI.

Describe the purpose of the use.

Explain how the consumer can limit that use via the specific link.

## What constitutes valid consent for cookies under the CPRA?

The CPRA uses an opt-out model for most personal information: processing is permitted by default for most purposes, and the consumer has the right to refuse selling and sharing.

But for sensitive personal information, the standard is different: use of SPI beyond essential purposes must be disclosed to the consumer, who has the right to limit that use.

And for consumers under 16, the standard is opt-in: the business cannot sell or share data of minors without active opt-in.

What is not valid as opt-out: processes requiring unnecessary multiple steps, account creation requirements to exercise opt-out, and any design that deliberately makes exercising the right more difficult.

## Special protection for minors

The CPRA has strict rules for minors that must be described in the Cookies Policy.

For consumers under 16: the business cannot sell or share personal information (including via advertising cookies) without active opt-in.

For consumers under 13: opt-in must be given by parents or legal guardians.

If a consumer under 16 declines consent, the business must wait 12 months before requesting consent again.

Penalties for violations involving data of consumers under 16 are tripled and automatic.

If the site may have users in these age ranges, the Cookies Policy must describe how advertising cookies are deactivated for this audience and how opt-in is obtained.

## Do analytics cookies constitute "sharing" under the CPRA?

Google Analytics, for example, collects browsing behavior data and sends it to Google's servers. Depending on how Google uses that data for its own advertising purposes or to provide advertising services to other advertisers, sending that data may constitute "sharing" under the CPRA.

The [ANPD Cookie Guidance](https://goadopt.io/en/blog/anpd-cookies-guidance-personal-data-protection-lgpd/) has documented how major analytics providers can cross-reference apparently anonymous data with other data they hold.

The safest approach: include Google Analytics in the category of cookies that may constitute sharing, offer opt-out, and document this categorization in the Cookies Policy.

## When to update the Cookies Policy

Situations requiring an update:

Adding a new advertising pixel or tracker.

A new analytics tool sending data to third parties.

A new partner receiving behavioral data from site users.

Changes to retention periods for any category.

Change in the use of cookie data for new purposes.

Any modification to opt-out mechanisms or mandatory links.

Continuous [data mapping](https://goadopt.io/en/blog/data-mapping-or-data-inventory/) is what keeps the cookie inventory synchronized with the document.

## How AdOpt helps with the Cookies Policy under the CPRA

AdOpt's automatic scan identifies all active technologies on the site, feeding the list of categories that must appear in the Cookies Policy.

The [cookie notice](https://goadopt.io/en/blog/operation-of-cookie-banner/) configured through AdOpt blocks non-necessary trackers before acceptance, presents categories with clear descriptions, honors the GPC automatically, and logs every interaction for audit purposes.

The integration with the "Do Not Sell or Share My Personal Information" link ensures that opt-outs are processed automatically and the corresponding trackers are deactivated.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Want to build a Cookies Policy for your site that complies with the CPRA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Checklist: what your Cookies Policy needs for the CPRA

**Visible link** in the footer and within the cookie notice.

**Listing of cookie categories** with a description of what each does on the site.

**Specific purpose for each category**, including whether it constitutes selling or sharing (Civil Code § 1798.100).

**Identification of cookies constituting "sharing"** for cross-context behavioral advertising (Civil Code § 1798.140(ah)).

**Categories of third parties** receiving data via cookies, including advertising platforms (Civil Code § 1798.130).

**Retention period** for each cookie category (Civil Code § 1798.130 a(5)(A)).

**"Do Not Sell or Share My Personal Information"** link visible on homepage and data collection pages (Civil Code § 1798.120).

**"Limit the Use of My Sensitive Personal Information"** link if SPI is collected via cookies (Civil Code § 1798.121).

**GPC recognized and honored** as a valid opt-out.

**Protection for consumers under 16**: mandatory opt-in for selling and sharing via advertising cookies.

**12-month waiting rule** after consumers under 16 decline consent.

**Accessible language**, without legal jargon.

**No unnecessary multiple steps** to exercise opt-out.

## FAQ: CPRA and Cookies Policy

**1. What is "sharing" of data under the CPRA and why is it different from "selling"?**
The CCPA used only the concept of "selling" data (exchange for monetary consideration). The CPRA added "sharing," defined in Civil Code § 1798.140(ah) as disclosing personal information to third parties for cross-context behavioral advertising purposes, regardless of whether there is direct payment. This means that when the Meta Pixel sends visitor behavior data from your site to Meta, this may constitute "sharing" under the CPRA even if the business receives no money specifically for that data. The CPRA requires opt-out from both selling and sharing.

**2. Is the GPC mandatory for sites serving California consumers?**
Yes, in practice. The CPPA confirmed that the GPC constitutes a valid form of opt-out from selling and sharing personal information under the CPRA. This means that if a visitor arrives at your site with the GPC enabled in their browser, the site is required to treat that signal as an opt-out from selling and sharing. Ignoring the GPC may constitute a CPRA violation. A properly configured CMP detects and honors the GPC automatically.

**3. Do analytics cookies like Google Analytics constitute "sharing" under the CPRA?**
It depends on how the provider uses the data. If Google Analytics only generates usage reports for the business that installed the tool, it may be configured as a service provider without constituting "sharing." If data is used by Google for its own advertising purposes or to provide advertising services to other advertisers, it may constitute sharing. Google offers privacy-safe configurations in GA4 that can reduce this risk. The safest approach is to offer opt-out and consult a specialist to evaluate the specific configuration.

**4. What must change in the Cookies Policy to update from CCPA to CPRA?**
The main changes are: replace references to "selling" data to include "selling and sharing"; add description of what constitutes sharing for cross-context behavioral advertising; update the opt-out link from "Do Not Sell My Personal Information" to "Do Not Sell or Share My Personal Information"; add the "Limit the Use of My Sensitive Personal Information" link if SPI is collected via cookies; include retention periods for each cookie category; and add mention of the GPC as a valid form of opt-out.

**5. If a consumer under 16 declines consent for advertising cookies, what can the business do?**
It may keep strictly necessary cookies active, as those do not require consent. It must deactivate all advertising and sharing cookies. And it must wait 12 months before requesting consent for advertising cookies again. This 12-month rule is one of the most specific elements of the CPRA compared to other US state laws, and it reflects the legislature's intent to protect minor consumers from repeated consent requests.

[Ready to build a Cookies Policy for your site that complies with the CPRA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)


California CPRA: Cookies Policy

The California Privacy Rights Act (CPRA) has a set of requirements for the privacy policy that goes further than any other US state law.

This page covers one piece of the picture. For the full scope of the CPRA — who must comply, the thresholds, the consumer rights and the penalties — start with our [complete guide to the CPRA and cookies](https://goadopt.io/en/blog/california-cpra-and-cookies-all-you-need-to-know/).

It is not just about what the document must contain. It is about two specific links that must be visible on every page of the site. It is about specifying data retention periods. It is about an entirely new category of sensitive data with its own rules.

This article focuses exclusively on what the CPRA requires from the Privacy Policy, based on the official text of the law.

## What the CPRA calls a Privacy Policy

The law uses the term "privacy policy." In California, legal tradition requires this document to be accessible on the homepage and on any page where personal information is collected.

The CPRA significantly expands what the original CCPA required. If your privacy policy was written for the 2020 CCPA, it is likely outdated on several critical points.

## What must be in the Privacy Policy under the CPRA

### 1. Categories of personal information collected

The document must list the categories of personal information the business collects (Civil Code § 1798.100).

This includes: identifiers (name, email, IP), legally protected characteristics, commercial information, biometric data, geolocation data, internet activity data, audio or visual data, professional information, education information, and inferences used to create consumer profiles.

### 2. Categories of sensitive personal information (SPI) collected

This is the CPRA's major innovation. The document must specifically identify whether the business collects sensitive personal information (Civil Code § 1798.121).

SPI includes: precise geolocation, financial account data with credentials, private communications, genetic data, biometric data, health data, sex life or sexual orientation, racial or ethnic origin, religious beliefs, and union membership.

If the business collects SPI, the policy must:

List the categories of SPI collected.

Describe the purposes for which SPI is used.

State whether use is limited to essential purposes or exceeds that.

Explain how the consumer can exercise the right to limit SPI use.

### 3. The purposes of processing

The document must describe the purposes for which categories of personal information are collected and used (Civil Code § 1798.100).

Purposes must be specific. "Improve our services" is not adequate. "Browsing behavior data collected via analytics cookies to identify pages with high abandonment rates and prioritize usability improvements" is the correct level of specificity.

### 4. Data retention periods

This is a new requirement that the original CCPA did not have and that the CPRA explicitly introduced.

The document must inform how long each category of personal information is retained, or the criteria used to determine that period (Civil Code § 1798.130 a(5)(A)).

The CPRA prohibits retaining personal information beyond what is necessary for the disclosed purposes. This has direct impact on businesses that were simply accumulating data without a cleanup schedule.

### 5. Consumer rights and how to exercise them

The document must describe all rights guaranteed by the CPRA and how consumers can exercise them (Civil Code § 1798.130).

Rights under the CPRA include:

Right to know: categories and specific information collected, sources, purposes, and third parties.

Right to access: a copy of information collected in the past 12 months.

Right to deletion: request deletion, with exceptions.

Right to correct: correction of inaccurate personal information (new under CPRA).

Right to portability: data in a usable format.

Right to opt-out of sale and sharing: refuse sale and sharing for cross-context behavioral advertising.

Right to limit SPI use: limit use of sensitive information to essential purposes (new under CPRA).

Right to non-discrimination: no penalties for exercising rights.

For each right, the policy must describe the submission channel and the response process within 45 days.

### 6. Categories of personal information shared with third parties

The document must identify the categories of personal information disclosed to third parties for business purposes, and the categories of third parties to whom that information was disclosed (Civil Code § 1798.130).

This covers analytics platforms, advertising tools, CRMs, payment processors, and any external service receiving user data.

### 7. Sale and sharing of data: required disclosure

If the business sells or shares personal information, the policy must identify:

The categories of personal information sold or shared.

The categories of third parties to which information was sold or shared.

Whether the business sells or shares personal information of consumers under 16 (with confirmation that opt-in was obtained, where applicable).

"Sharing" under the CPRA means disclosing personal information for cross-context behavioral advertising even without direct payment. This includes sharing data with advertising networks via pixels, even if the business receives no money for that specific sharing.

### 8. The two mandatory links on the site

Beyond the content of the policy, the CPRA requires two links that must be visible on the homepage and on any page where personal information is collected:

**"Do Not Sell or Share My Personal Information"**: for opt-out of selling and sharing data for cross-context behavioral advertising.

**"Limit the Use of My Sensitive Personal Information"**: for consumers to limit use of sensitive information to essential purposes.

These links may be combined into a single link if both opt-out options are available on the same destination page.

The privacy policy must describe these links and how they work.

## The sensitive personal information category: additional requirements

The CPRA created a new layer of control for sensitive personal information that did not exist in the CCPA.

The business may use SPI only for essential purposes, unless the consumer has not exercised the limitation right. Essential purposes include: providing the requested service or product, security and integrity, debugging, reasonable internal research, and legal compliance.

If the business uses SPI for purposes beyond those, the policy must make that explicit and the consumer must have the option to limit that additional use.

The retention period for SPI must be specified. And sensitive information cannot be retained beyond what is necessary for the declared purpose.

## Protection for minors: what the policy must cover

The CPRA has specific minor protections that must be reflected in the privacy policy.

For **consumers under 16**: the business cannot sell or share personal information without active opt-in. The policy must describe how this opt-in is obtained.

For **consumers under 13**: consent must be given by parents or legal guardians. The policy must describe the parental consent process.

If a consumer under 16 declines consent for sale or sharing, the business must wait 12 months before requesting consent again. The policy must mention this rule.

Penalties for violations involving data of consumers under 16 are tripled and automatic. This should motivate special attention to this segment in the policy.

## Cookies and advertising: what the policy must say

The CPRA expanded "selling" to include "sharing." This directly impacts how the privacy policy describes the use of advertising cookies.

If the site uses Meta Pixel, Google Ads, TikTok Pixel or any pixel that sends behavioral data to external advertising networks, this may constitute "sharing" of personal information under the CPRA, even if the business receives no direct payment for those specific data.

The policy must:

Identify the types of cookies and trackers used.

State whether data is shared with third parties for cross-context behavioral advertising.

Describe how the consumer can opt out of sharing (via the "Do Not Sell or Share" link or the GPC).

The site's [cookie notice](https://goadopt.io/en/blog/operation-of-cookie-banner/) must align with what is described in the privacy policy.

## Data Protection Assessments: what the policy needs to address

The CPRA requires businesses to conduct periodic privacy risk assessments for high-risk activities, including processing of SPI, selling and sharing of data, and processing presenting significant risk to consumer rights.

Assessments do not need to be published in the policy, but the policy should state that the business conducts privacy risk assessments for high-risk activities as part of its compliance program.

The CPPA may request these assessments during investigations.

## Non-discrimination and loyalty programs

The CPRA prohibits discrimination against consumers who exercise their rights, including denying goods or services, charging different prices, or offering lower quality.

The exception is loyalty, rewards, premium features, or discount programs where the price or quality difference is reasonably related to the value the business derives from the consumer's data, provided the consumer participates voluntarily.

The privacy policy must describe this non-discrimination policy and any applicable exceptions.

## How AdOpt supports CPRA compliance

AdOpt ensures that what is written in the policy has real correspondence with what actually happens on the site.

The automatic scan identifies all active technologies, feeding the list of data categories and third parties that must appear in the document. The [consent management platform](https://goadopt.io/en/blog/how-to-choose-cmp-consent-management-platform/) ensures that opt-out links work as described, the GPC is honored automatically, and opt-out records are available for audit.

Every interaction is logged. If the CPPA requests evidence, the record is available.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Want to build a Privacy Policy for your site that complies with the CPRA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Checklist: what the Privacy Policy must contain for the CPRA

**Visible and accessible link** on the homepage and on all pages where personal information is collected.

**"Do Not Sell or Share My Personal Information"** link visible on homepage (Civil Code § 1798.120).

**"Limit the Use of My Sensitive Personal Information"** link visible on homepage if SPI is collected (Civil Code § 1798.121).

**Categories of personal information collected**, with specific description of each category (Civil Code § 1798.100).

**Categories of sensitive personal information (SPI)** collected, if applicable (Civil Code § 1798.121).

**Purposes of processing** for each category, without vague descriptions.

**Retention periods** for each data category, or criteria used to determine retention (Civil Code § 1798.130 a(5)(A)).

**All consumer rights** listed with submission process and 45-day response deadline.

**Free service** for up to two requests per consumer per year (Civil Code § 1798.130 a(3)).

**Categories of personal information sold or shared** and categories of recipient third parties.

**Protection for consumers under 16**: mandatory opt-in for sale and sharing.

**Protection for consumers under 13**: parental consent.

**12-month waiting rule** after minors under 16 decline consent.

**Non-discrimination policy** for consumers exercising their rights.

**Reference to privacy risk assessments** for high-risk activities.

## FAQ: CPRA and Privacy Policy

**1. My privacy policy was written for the CCPA. What are the main updates needed for the CPRA?**
The main updates are: add the sensitive personal information (SPI) category with its specific rules; describe the new right to correct data; describe the right to limit SPI use; include retention periods for each data category; update the "selling" section to include "sharing" for cross-context behavioral advertising; add the two mandatory links ("Do Not Sell or Share" and "Limit Use of SPI"); and reference the CPPA as the regulatory agency instead of the Attorney General.

**2. What are the "Do Not Sell or Share" and "Limit the Use of My Sensitive Personal Information" links?**
These are two links the CPRA requires to be visible on the homepage and on any page where personal information is collected. The first ("Do Not Sell or Share My Personal Information") allows consumers to opt out of selling and sharing personal information for cross-context behavioral advertising. The second ("Limit the Use of My Sensitive Personal Information") allows consumers to restrict use of sensitive personal information to essential purposes. Both links may be combined into a single link if both options are on the same destination page.

**3. Why does the CPRA require specifying data retention periods in the privacy policy?**
The CPRA introduced an explicit prohibition on retaining personal information beyond what is necessary for the declared purposes. As a result, businesses must know how long they retain each data category and communicate that to consumers. Civil Code § 1798.130 a(5)(A) requires the policy to specify retention periods or criteria used to determine them. This rule closes a gap that existed under the CCPA, where businesses could accumulate data indefinitely.

**4. What changes for data of teenagers aged 13 to 15 under the CPRA?**
The CCPA already required opt-in for selling data of consumers under 16. The CPRA added a new rule: if a consumer under 16 declines consent for selling or sharing their data, the business must wait 12 months before making a new consent request. This prevents businesses from repeatedly re-presenting the consent request. Penalties for violations involving data of consumers under 16 are tripled and automatic.

**5. Does the CPRA have a private right of action? In what situations can consumers sue the business directly?**
Yes. The CPRA preserves and expands the private right of action introduced by the CCPA. Consumers can sue the business directly when there is an unauthorized data breach resulting in unauthorized access, theft, disclosure, use, modification, or destruction of unencrypted, unredacted personal information. Categories include Social Security numbers, financial account credentials, debit or credit card data with security codes, medical information, health insurance information, and other categories specified in the law. Minimum damages per consumer per incident are US$ 100 to US$ 750, or actual damages, whichever is greater. Class actions are permitted.

[Ready to build a Privacy Policy for your site that complies with the CPRA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)


California CPRA: Privacy Policy

California has one of the most detailed privacy policy requirements among all US state privacy laws.

This page covers one piece of the picture. For the full scope of the CCPA — who must comply, the thresholds, the consumer rights and the penalties — start with our [complete guide to the CCPA and cookies](https://goadopt.io/en/blog/california-ccpa-and-cookies-all-you-need-to-know/).

The California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA) and codified at Cal. Civ. Code § 1798.100 et seq., requires the privacy notice to be updated every 12 months and to contain specific lists of what was collected, sold, shared, and disclosed in the preceding year.

This article focuses exclusively on what the CCPA/CPRA requires from your Privacy Policy, based on the official text of the law.

## Did the CPRA change what the CCPA requires from the Privacy Policy?

Yes, significantly. The CPRA (Proposition 24, operative since January 2023) expanded the transparency obligations of the privacy notice in three main areas:

Added the obligation to disclose the category of **sensitive personal information** when collected.

Added the **two new mandatory links** on the site: "Do Not Sell or Share My Personal Information" and "Limit the Use of My Sensitive Personal Information."

Reinforced **data minimization** and **proportionate retention** requirements, requiring the Policy to include the period the business intends to retain each category of data.

For more on what the CPRA specifically changed, we have a dedicated guide on the [California CPRA](https://goadopt.io/en/blog/california-cpra-and-cookies-all-you-need-to-know/). This article covers the current consolidated law.

## What must be in the Privacy Policy under the CCPA/CPRA

### 1. Categories of personal information collected

The privacy notice must list the categories of personal information collected about consumers in the **preceding 12 months** (§ 1798.130(a)(5)(B)).

The CCPA/CPRA establishes specific categories that must be used for this description, under § 1798.140(v):

Identifiers (name, address, IP address, email, Social Security number, etc.).

Personal information described in Section 1798.80 of California law.

Characteristics of protected classifications under California or federal law.

Commercial information (records of property, purchase history).

Biometric information.

Internet or other electronic network activity (browsing history, search history, ad interactions).

Geolocation data.

Audio, electronic, visual, thermal, olfactory, or similar information.

Professional or employment-related information.

Education information.

Inferences drawn to create profiles about preferences, characteristics, behavior, and aptitudes.

Sensitive personal information.

### 2. Categories of sources of personal information

The privacy notice must identify the categories of sources from which consumers' personal information is collected (§ 1798.130(a)(5)(B)(ii)).

Typical sources include: the consumer directly through forms, analytics systems, advertising networks, data partners, social media, and publicly available sources.

### 3. The business or commercial purpose for collecting, selling, or sharing

The notice must explain what the data is used for (§ 1798.130(a)(5)(B)(iii)).

The CCPA/CPRA defines "business purpose" (§ 1798.140(e)) with specific categories: auditing ad impression counts, ensuring security and integrity, debugging errors, short-term transient use, performing services on behalf of the business, advertising and marketing (except cross-context behavioral advertising), internal research, and quality verification activities.

### 4. Categories of third parties with whom data is shared

The notice must identify the categories of third parties with whom the business shares consumers' personal information (§ 1798.130(a)(5)(B)(iv)).

### 5. List of categories sold or shared in the preceding 12 months

§ 1798.130(a)(5)(C) requires the privacy notice to include:

A list of categories of personal information **sold or shared** about consumers in the preceding 12 months, by category; or a statement that the business has not sold or shared personal information.

A list of categories **disclosed for business purposes** in the preceding 12 months; or a statement that no such disclosure occurred.

These two lists must be kept separate in the privacy notice.

### 6. Consumer rights and how to exercise them

The notice must describe the rights guaranteed by the CCPA/CPRA and the designated methods for submitting requests (§ 1798.130(a)(5)(A)):

Right to know and access (§ 1798.100, 1798.110, 1798.115).

Right to deletion (§ 1798.105).

Right to correction of inaccurate data (§ 1798.106).

Right to opt-out of sale and sharing (§ 1798.120).

Right to limit use of sensitive personal information (§ 1798.121).

Right of non-discrimination (§ 1798.125).

And the two or more designated methods for submitting requests, including at minimum a toll-free telephone number.

### 7. Retention period for each category

§ 1798.100(a)(3) requires that, at or before the point of collection, the business inform consumers of the length of time it intends to retain each category of personal information, including sensitive personal information, or the criteria used to determine that period.

The business shall not retain a consumer's personal information for longer than is reasonably necessary for the disclosed purpose.

## The two mandatory links on the homepage

§ 1798.135 requires the Privacy Policy to mention and the site to provide, clearly and conspicuously:

**"Do Not Sell or Share My Personal Information":** a link to a page where the consumer can opt out of the sale and sharing of their data. Sharing, defined as transfer for cross-context behavioral advertising, is included even without monetary consideration.

**"Limit the Use of My Sensitive Personal Information":** a link that allows the consumer to limit the use of sensitive personal information to what is necessary to provide the products or services reasonably expected.

The business may use a single combined link that clearly allows exercising both options.

Alternatively, the business may honor the opt-out preference signal of the **Global Privacy Control (GPC)** when sent by the consumer, instead of maintaining the links. In that case, the Policy must state that the site respects the GPC.

## Disclosure of sensitive personal information

If the business collects sensitive personal information, the privacy notice must expressly disclose this (§ 1798.100(a)(2)).

Sensitive personal information under the CCPA/CPRA (§ 1798.140(ae)) includes: Social Security number, driver's license, or passport number; login credentials and financial account access codes; precise geolocation; racial or ethnic origin, citizenship status, religious beliefs, union membership; contents of private communications; genetic data; neural data; biometric data for identification; health information; sex life or sexual orientation.

For each category of sensitive information collected, the Policy must explain:

For what specific purpose it is collected.

Whether it is sold or shared, and with whom.

How the consumer can limit its use (via "Limit the Use of My Sensitive Personal Information" link or via GPC).

## The 12-month lookback

A specific feature of the CCPA/CPRA is the 12-month lookback in access requests.

When a consumer makes an access request, the response must cover the period of 12 months preceding receipt of the request (§ 1798.130(a)(2)(B)).

After adoption of specific regulations, the consumer may request information beyond 12 months for data collected from January 1, 2022, if it is not impossible or would not involve disproportionate effort.

The Privacy Policy must mention this 12-month lookback so the consumer understands which time period is covered by their request.

## Request submission methods: the toll-free number is mandatory

§ 1798.130(a)(1) requires two or more designated methods for submitting requests, including at minimum a **toll-free telephone number**.

Businesses that operate exclusively online with a direct consumer relationship may limit themselves to an email address.

The business must make its website available for request submission if it maintains a website.

The business cannot require the consumer to create a new account to exercise their rights. It may require use of an existing account.

Data collected for identity verification may be used only for that purpose, not for other uses (§ 1798.130(a)(7)).

## Protection for consumers under 16 years of age

If the business may have consumers under 16 years of age, the Privacy Policy must describe the special protections applicable:

For consumers between 13 and 15: the business cannot sell or share data without affirmative authorization from the consumer themselves (§ 1798.120(c)).

For consumers under 13: parental or guardian authorization is required.

A business that willfully disregards the consumer's age is deemed to have actual knowledge of it.

The [data protection officer](https://goadopt.io/en/blog/responsibilities-of-a-data-protection-officer/) must ensure that the age verification process, where applicable, is operational and documented.

## The private right of action and the Privacy Policy

§ 1798.150 grants the consumer the private right of action for security breaches, with damages of US$ 100 to US$ 750 per consumer per incident.

Before initiating any action for statutory damages, the consumer must provide written notice to the business 30 days in advance. If the business cures the violation within the period and provides a written statement that no further violations will occur, no action may be initiated.

The Privacy Policy must mention this right and how the consumer can exercise it.

## The mandatory annual update

§ 1798.130(a)(5) requires the privacy notice to be updated **at least once every 12 months**.

This update must reflect what was collected, sold, shared, and disclosed for business purposes in the preceding 12 months. A generic, outdated notice is not sufficient: the business needs an internal mandatory annual review process.

Situations requiring immediate update, in addition to the annual review:

Adding a new category of data collected.

New third parties receiving data.

Changes in sale or sharing practices.

New purposes for data use.

Any change to opt-out links or submission methods.

## Enforcement and penalties

CCPA/CPRA violations are investigated and enforced by the **California Privacy Protection Agency (CPPA)** and the **California Attorney General**.

The CPPA can impose administrative fines of up to **US$ 2,500 per violation** and up to **US$ 7,500 for intentional violations** or violations involving minors. The Attorney General can seek civil penalties in the same amounts.

There is no guaranteed cure period before CPPA actions. The agency has discretion to investigate without any obligation to grant advance notice.

## How AdOpt supports CCPA/CPRA compliance

AdOpt ensures that what is written in the Policy has real correspondence with what actually happens on the site.

The automatic scan identifies all active technologies, feeding the list of data categories and third parties. The [consent management platform](https://goadopt.io/en/blog/how-to-choose-cmp-consent-management-platform/) ensures that the opt-out and sensitive information limitation mechanisms work as described.

The GPC is honored automatically when sent by the user. Every consent interaction is logged. If the CPPA or Attorney General requests evidence, the record is available.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Want to build a Privacy Policy for your site that complies with the CCPA/CPRA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Checklist: what the Privacy Policy must contain for the CCPA/CPRA

**Visible and accessible link** on all pages of the site.

**Updated at least once every 12 months** (§ 1798.130(a)(5)).

**Categories of personal information collected** in the preceding 12 months (§ 1798.130(a)(5)(B)(i)).

**Categories of sources** of personal information (§ 1798.130(a)(5)(B)(ii)).

**Business or commercial purpose** for collecting, selling, or sharing (§ 1798.130(a)(5)(B)(iii)).

**Categories of third parties** with whom data is shared (§ 1798.130(a)(5)(B)(iv)).

**List of categories sold or shared** in the preceding 12 months (§ 1798.130(a)(5)(C)(i)).

**List of categories disclosed for business purposes** in the preceding 12 months (§ 1798.130(a)(5)(C)(ii)).

**Consumer rights and how to exercise them**, with process and deadlines (§ 1798.130(a)(5)(A)).

**Two or more submission methods**, including a toll-free telephone number (§ 1798.130(a)(1)).

**"Do Not Sell or Share My Personal Information" link** or statement of honoring GPC (§ 1798.135).

**"Limit the Use of My Sensitive Personal Information" link** when applicable (§ 1798.121, 1798.135).

**Categories of sensitive personal information** collected, when applicable (§ 1798.100(a)(2)).

**Retention period** for each category of data (§ 1798.100(a)(3)).

**12-month lookback** for access requests mentioned (§ 1798.130(a)(2)(B)).

**Private right of action** for security breaches mentioned (§ 1798.150).

**Protection for minors** aged 13 to 15 and under 13 (§ 1798.120(c)).

**Non-discrimination policy** for consumers exercising their rights (§ 1798.125).

## FAQ: CCPA/CPRA and Privacy Policy

**1. How often does the Privacy Policy need to be updated under the CCPA/CPRA?**
At least once every 12 months, under § 1798.130(a)(5). This goes beyond updating only when there are material changes. The business needs a mandatory annual review process, and the lists of categories sold, shared, and disclosed in the preceding 12 months must be regularly updated.

**2. What is the "12-month lookback" and how does it affect the Privacy Policy?**
§ 1798.130(a)(2)(B) requires that the response to a consumer access request cover the 12 months preceding receipt of the request. The Privacy Policy must mention this period so the consumer understands which time window is covered by their request.

**3. Does the Privacy Policy need to mention the CCPA private right of action?**
Yes. § 1798.150 grants consumers the right to file civil lawsuits for security data breaches. The Policy must mention this right and the process: the consumer must provide written notice to the business 30 days in advance before initiating action for statutory damages.

**4. Is the toll-free telephone number really mandatory?**
Yes. § 1798.130(a)(1) requires the business to provide two or more designated methods for submitting requests, including at minimum a toll-free telephone number. The exception applies to businesses that operate exclusively online with a direct consumer relationship, which may limit themselves to an email address.

**5. What did the CPRA add that was not in the original CCPA?**
The CPRA added: the right to correct inaccurate data (§ 1798.106), the right to limit use of sensitive personal information (§ 1798.121), the mandatory "Limit the Use of My Sensitive Personal Information" link, the distinction between "sale" and "sharing" for behavioral advertising, the expanded definition of sensitive personal information (including neural data), and data minimization and proportionate retention requirements. All of this must be reflected in the Privacy Policy.

[Ready to build a Privacy Policy for your site that complies with the CCPA/CPRA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)


California CCPA: Privacy Policy

California has a requirement that no other US state privacy law has: the "Do Not Sell or Share My Personal Information" link visibly displayed on the homepage.

This page covers one piece of the picture. For the full scope of the CCPA — who must comply, the thresholds, the consumer rights and the penalties — start with our [complete guide to the CCPA and cookies](https://goadopt.io/en/blog/california-ccpa-and-cookies-all-you-need-to-know/).

That link exists because of cookies.

When a site installs an advertising pixel, that pixel collects data about user behavior and sends it to the advertising platform. This constitutes "sharing" of data for cross-context behavioral advertising under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA). And sharing requires an opt-out.

This article focuses exclusively on what the CCPA/CPRA requires from a Cookies Policy: what must be in the document, how consent and opt-out must work, and what the law's specific requirements mean for each tracker on your site.

## Cookies Policy vs. cookie banner: the necessary distinction

The [cookie banner](https://goadopt.io/en/blog/how-to-choose-a-cookie-banner-for-your-website/) is the visual interface. It is what the visitor sees when they access the site and where they make choices about what they accept.

The Cookies Policy is the detailed document. It is where the user finds complete information about every technology operating on the site: what it collects, what it is for, who receives the data, how long it is retained, and how to exercise rights.

Both need to exist. Both need to be aligned. And the Cookies Policy must be accessible from a link within the [consent notice](https://goadopt.io/en/blog/operation-of-cookie-banner/) itself.

## "Sale" and "sharing" of data via cookies

The distinction created by the CPRA is fundamental to understanding what the CCPA requires in the context of cookies.

**Sale** (§ 1798.140(ad)): transfer of data for monetary or other valuable consideration to third parties.

**Sharing** (§ 1798.140(ah)): transfer of data to third parties for cross-context behavioral advertising, with or without monetary consideration.

Cross-context behavioral advertising (§ 1798.140(k)): ads targeted based on personal information obtained from consumer activity across different businesses, distinctly branded websites, applications, or services.

In practice: if your site has a pixel that sends user behavior data to an advertising platform to display ads on other sites, that is "sharing" under the CCPA/CPRA, even if you receive no money directly. And sharing requires:

The "Do Not Sell or Share My Personal Information" link on the homepage.

Clear and conspicuous disclosure in the privacy notice.

Honoring the opt-out when exercised.

## What the CCPA/CPRA specifically requires for cookies

### Specific purpose for each category

§ 1798.100(a)(1) requires the business to inform consumers, at or before the point of collection, of the categories of personal information to be collected and the purposes for which they are collected or used, and whether that information is sold or shared.

For cookies, each tracker category needs a specific purpose description. "Cookies to improve your experience" is not a purpose.

What works:

"Analytics cookies: collect browsing behavior data including pages visited, traffic source, and session duration. Used to identify opportunities for content improvement. This data is not sold or shared with third parties for advertising."

"Advertising cookies: collect behavioral identifiers that are shared with advertising platforms for cross-context behavioral advertising. Data is shared with partners such as Meta Ads and Google Ads. Consumers can opt out via the 'Do Not Sell or Share My Personal Information' link."

### Cookie categories present on the site

The Policy must list the tracker categories:

**Necessary cookies:** essential for basic functionality. Do not constitute sale or sharing and do not require the opt-out link. But must be documented.

**Analytics cookies:** depends on configuration. If data stays within company systems and is not sent to third parties for targeting, they generally do not constitute "sale" or "sharing." But most major analytics platform cookies send data to the provider, which may constitute a business purpose disclosure.

**Advertising and retargeting cookies:** almost always constitute "sharing" under the CCPA/CPRA. Meta Pixel, Google Ads, TikTok Pixel, programmatic DSP pixels: all send data to platforms that use that data to display behavioral ads to the user on other sites.

**Functional cookies:** remember user preferences. Generally do not constitute sale or sharing if the data stays internal.

**Third-party cookies:** fired by external services integrated into the site. [Correct tag categorization](https://goadopt.io/en/blog/difference-cookies-local-storage-session-storage/) is what makes it possible to document each one accurately.

### Who receives data via cookies

The Policy must identify the categories of third parties receiving data via cookies.

§ 1798.115(a) requires the business to disclose, upon consumer request, the categories of third parties to whom it sold or shared data, by category of personal information.

For cookies, this means documenting that, for example: browsing behavior data was shared with digital advertising platforms; session data was disclosed to analytics service providers; user identifiers were shared with programmatic advertising networks.

### Retention period for each category

§ 1798.100(a)(3) requires the business to disclose the length of time it intends to retain each category of data, or the criteria used to determine that period.

For cookies, the Policy must document:

How long each cookie category remains active on the user's device.

How long data collected via cookies is retained in company systems.

Whether and when data is deleted.

## The Global Privacy Control (GPC): how to handle it in the context of cookies

§ 1798.135(b) allows the business to comply with opt-out requirements by honoring the opt-out preference signal sent by platforms, technologies, or mechanisms with the consumer's consent.

The Global Privacy Control (GPC) is the best-known mechanism implementing this functionality. When the user activates the GPC in their browser, the site must interpret this signal as an opt-out of sale and sharing.

The Cookies Policy must state whether the site respects the GPC and how this mechanism works.

A well-configured [consent management platform](https://goadopt.io/en/blog/how-to-choose-cmp-consent-management-platform/) detects and honors the GPC automatically.

## The "Limit the Use of My Sensitive Personal Information" link and cookies

Precise geolocation data (radius of 1,850 feet or less) is sensitive personal information under the CCPA/CPRA (§ 1798.140(ae)(1)(C)).

If the site collects precise geolocation data via cookies or location scripts for purposes beyond what is necessary to provide the requested product or service, the consumer has the right to limit this use via the "Limit the Use of My Sensitive Personal Information" link (§ 1798.121).

The Cookies Policy must identify whether precise geolocation data is collected, what it is used for, and how the consumer can limit its use.

## Special protection for consumers under 16 years of age

§ 1798.120(c) prohibits the sale or sharing of data of consumers under 16 without affirmative authorization.

For consumers between 13 and 15: the consumer's own authorization.

For consumers under 13: parental or legal guardian authorization.

If the site may have users under 16, the Cookies Policy must describe how data from those users is treated differently, including how advertising cookies are blocked without adequate authorization.

## When to update the Cookies Policy

§ 1798.130(a)(5) requires updating the privacy notice at least once every 12 months. For the Cookies Policy, this means a mandatory annual review.

Situations requiring immediate update:

Adding a new advertising pixel.

A new analytics tool that sends data to third parties.

A new chat or support plugin.

A new CRM or email marketing platform integration.

Any new partner receiving behavioral data.

Continuous [data mapping](https://goadopt.io/en/blog/what-is-privacy-by-design/) is what keeps the cookie inventory synchronized with the document.

## The CCPA/CPRA anti-avoidance provision

§ 1798.190 provides that transactions or series of steps intentionally created to avoid the definition of "sale" or "sharing," including eliminating monetary consideration to circumvent the law, will be disregarded.

This means that structuring data exchange agreements without monetary consideration to avoid the opt-out is not a valid strategy. The CCPA/CPRA looks at the substance of the transaction, not just its form.

## Enforcement and penalties

The **California Privacy Protection Agency (CPPA)** can impose administrative fines of up to **US$ 2,500 per violation** and up to **US$ 7,500 for intentional violations** or violations involving minors. The **Attorney General** can seek civil penalties in the same amounts.

There is no guaranteed cure period before CPPA actions. The agency has discretion to investigate and act.

Additionally, § 1798.150 grants consumers the private right of action for security breaches: US$ 100 to US$ 750 per consumer per incident.

## How AdOpt helps with the Cookies Policy under the CCPA/CPRA

AdOpt's automatic scan identifies all technologies active on the site, feeding the list of categories that must appear in the Cookies Policy.

The [cookie notice](https://goadopt.io/en/blog/operation-of-cookie-banner/) configured through AdOpt blocks non-essential trackers before acceptance, presents categories with clear descriptions, offers real opt-out options, honors the GPC automatically, and logs every interaction for audit purposes.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Want to build a Cookies Policy for your site that complies with the CCPA/CPRA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Checklist: what your Cookies Policy needs for the CCPA/CPRA

**Visible link** in the site footer and within the cookie banner.

**Listing of cookie categories** with a description of what each one does.

**Specific purpose for each category**, including a statement of whether data is sold or shared.

**Identification of cookies that constitute "sale" or "sharing"** under the CCPA/CPRA definition.

**Categories of third parties** that receive data via cookies.

**"Do Not Sell or Share My Personal Information" link** on the homepage when there is sale or sharing.

**"Limit the Use of My Sensitive Personal Information" link** when precise geolocation data is collected for purposes beyond the necessary.

**Global Privacy Control (GPC):** statement that the site honors the signal when sent by the user.

**Retention period** for each cookie category.

**Protection for minors** aged 13 to 15 and under 13.

**Annual update** of the document.

**Accessible language**, without legal jargon.

**No dark patterns** in opt-out mechanisms.

## FAQ: CCPA/CPRA and Cookies Policy

**1. Does an advertising pixel always constitute "sharing" under the CCPA/CPRA?**
Almost always, yes. The CCPA/CPRA defines "sharing" as the transfer of data for cross-context behavioral advertising, with or without monetary consideration. A pixel that sends user behavior data from your site to a platform that uses that data to display ads to the same user on other sites constitutes sharing. The site needs the "Do Not Sell or Share My Personal Information" link and must honor the opt-out.

**2. Does Google Analytics constitute "sharing" under the CCPA/CPRA?**
It depends on the configuration. Google Analytics in its default configuration sends data to Google, which has its own data use policies. If that data is used by Google for ad targeting on other sites (which may occur depending on settings), there is a risk of constituting sharing. The safest approach is to use GA with enhanced privacy settings and review the data processing terms with Google.

**3. What is the Global Privacy Control (GPC) and must the site respect it?**
The GPC is a browser signal that the user can activate to indicate their opt-out preference for sale and sharing of data. § 1798.135(b) allows the business to comply with opt-out requirements by honoring the GPC, instead of maintaining the "Do Not Sell or Share" and "Limit Sensitive PI" links on the site. Both approaches are valid: visible links on the site, or honoring the GPC. The business may choose one of the two strategies.

**4. Do analytics cookies need the "Do Not Sell or Share" link under the CCPA/CPRA?**
It depends on how the data is used. If analytics data stays only within company systems and is not sent to third parties for targeting purposes, it generally does not constitute "sale" or "sharing." But if the analytics tool is from a major provider that may use the data for other purposes including targeting, there is risk. Reviewing the tool's data processing terms is essential.

**5. What happens if the consumer opts out and the site continues sharing data?**
Continued sale or sharing after opt-out is a direct violation of § 1798.120(d). The CPPA may investigate and impose fines of up to US$ 2,500 per violation or US$ 7,500 for intentional violations. Additionally, the affected consumer may have grounds for a civil lawsuit. The business must wait at least 12 months before requesting the consumer's consent to sale or sharing again.

[Ready to build a Cookies Policy for your site that complies with the CCPA/CPRA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)


California CCPA: Cookies Policy

---
meta_description: "How to handle DSARs under the California CCPA/CPRA: 7 consumer rights, 45-day deadline, toll-free number required, 12-month lookback, private right of action for breaches, and CPPA enforcement."
---

This page covers one piece of the picture. For the full scope of the CCPA — who must comply, the thresholds, the consumer rights and the penalties — start with our [complete guide to the CCPA and cookies](https://goadopt.io/en/blog/california-ccpa-and-cookies-all-you-need-to-know/).

## California CCPA: DSAR and the Privacy Portal

California has the most developed consumer rights system among all US state privacy laws.

It is not just the number of rights guaranteed by the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA). It is the specificity of the processes, the precise deadlines, the private right of action for security breaches, and the existence of an independent regulatory agency with enforcement power.

This article covers all of it: what a DSAR is under the CCPA/CPRA, what rights are guaranteed, how to structure the Privacy Portal, the exact deadlines, and what happens when the business does not comply.

## What is a DSAR under the CCPA/CPRA?

DSAR stands for Data Subject Access Request, or Verifiable Consumer Request in the language of the CCPA. It is any formal request from a California resident to exercise the rights the law grants over their own data.

Under the CCPA/CPRA, the consumer can make verifiable requests to exercise six main rights, plus the private right of action for security breaches, which has its own flow.

If you are already familiar with the [GDPR](https://goadopt.io/en/blog/gdpr-cookies-explained/) data subject rights framework, the structure is familiar. The CCPA/CPRA uses the term "verifiable consumer request" to describe authenticated requests.

## What are consumer rights under the CCPA/CPRA?

### 1. Right to know and access (§ 1798.110, 1798.115)

The consumer may request that the business confirm whether it processes their data and disclose:

The categories of personal information collected.

The categories of sources.

The business or commercial purpose for collecting, selling, or sharing.

The categories of third parties with whom data was shared.

The **specific pieces** of personal information collected about the consumer.

The response must cover the **preceding 12 months** from the date of receipt.

If the business sells or shares data, the request also covers:

Categories of data sold or shared, by category of third party.

Categories of data disclosed for business purposes, separately.

### 2. Right to deletion (§ 1798.105)

The consumer may request deletion of any personal information the business collected about them.

The business must delete the data from its own records and **notify service providers, contractors, and third parties** to also delete, unless impossible or involving disproportionate effort.

The business may maintain a confidential record of deletion requests solely to prevent the data of a consumer who requested deletion from being resold.

Exceptions allowing retention even after a deletion request include: completing ongoing transactions, ensuring security, debugging errors, exercising free speech, complying with law, conducting approved public research, and fulfilling a legal obligation.

### 3. Right to correction (§ 1798.106)

Added by the CPRA. The consumer may request the business to correct inaccurate personal information, taking into account the nature of the data and the purposes of processing.

The business must use commercially reasonable efforts to correct the data as directed by the consumer.

### 4. Right to opt-out of sale and sharing (§ 1798.120)

The consumer may, at any time, direct the business not to sell or share their personal information with third parties.

After receiving the consumer's direction, the business may not sell or share the data unless the consumer subsequently provides consent.

The business must wait at least **12 months** before requesting the consumer to again authorize sale or sharing (§ 1798.135(c)(4)).

For consumers under 16 who did not consent to sale or sharing, the business must wait at least **12 months** before requesting consent again, or until the consumer turns 16 (§ 1798.135(c)(5)).

### 5. Right to limit use of sensitive personal information (§ 1798.121)

Added by the CPRA. The consumer may direct the business to limit the use of sensitive personal information to what is necessary to provide the products or services reasonably expected.

After receiving the consumer's direction, the business may not use the sensitive information for other purposes unless the consumer provides new consent.

### 6. Right of non-discrimination (§ 1798.125)

The consumer may not be discriminated against for exercising any right guaranteed by the CCPA/CPRA. The business cannot deny products or services, charge different prices, provide different quality, or suggest differential treatment.

The exception is voluntary financial incentive programs where the price or quality difference is reasonably related to the value the data represents to the business.

### The private right of action for security breaches (§ 1798.150)

This right has a different flow from the others. A consumer whose unencrypted and unredacted data is accessed or exposed in a security breach may file a civil lawsuit to recover **US$ 100 to US$ 750** per consumer per incident, or actual damages when greater, plus injunctive relief.

Before initiating any action for statutory damages, the consumer must provide written notice to the business **30 days in advance**, identifying the specific violations. If the business cures within the period and provides a written statement that no further violations will occur, no action may be initiated.

## What are the response deadlines?

The CCPA/CPRA is specific on deadlines.

**45 days** from receipt of a verifiable consumer request (§ 1798.130(a)(2)(A)).

The deadline can be extended by another **45 days** when reasonably necessary, considering the complexity and number of requests, as long as the consumer is notified within the initial period with the justification and reason for the delay (§ 1798.145(h)(1)).

Service is free. The business is not obligated to provide the same information to the same consumer more than **twice in a 12-month period** (§ 1798.130(b)).

## What is a "verifiable consumer request"?

The CCPA/CPRA uses the term "verifiable consumer request" (§ 1798.140(ak)) to describe requests that the business can verify were made by the consumer themselves, by a minor child's parent, by an authorized representative, or by a person with power of attorney.

The business may authenticate the request using commercially reasonable methods. It may require authentication proportionate to the nature of the information requested, but cannot require the consumer to create a new account. If the consumer already has an account, the business may require use of that account.

Data collected for identity verification may only be used for that purpose, not for other uses (§ 1798.130(a)(7)).

## What should the request submission channel look like?

§ 1798.130(a)(1) requires two or more designated methods for submitting requests, including at minimum a **toll-free telephone number**.

Businesses that operate exclusively online with a direct consumer relationship may limit themselves to an email address.

If the business maintains a website, it must make it available as a submission channel.

The business cannot require the consumer to create a new account, but may require use of an existing account.

A structured Privacy Portal offers:

A submission form with clear categories (know/access, delete, correct, opt-out of sale/sharing, limit sensitive PI use).

A proportionate and non-discriminatory identity verification process.

Automatic receipt confirmation.

A log of each request, action taken, and response sent.

## Requests from authorized representatives

The consumer may authorize another person to exercise their rights on their behalf, including through the GPC opt-out preference signal (§ 1798.135(e)).

An authorized agent may submit requests. The business may require proof that the agent was properly authorized by the consumer.

Parents or guardians may exercise rights on behalf of minor children.

## Free service: what the law says

Service is free (§ 1798.130(a)(2)(A)). But the business is not obligated to provide the same information to the same consumer more than **twice in a 12-month period** (§ 1798.130(b)).

For manifestly unfounded, excessive, or repetitive requests, the business may charge a reasonable fee for administrative costs or decline. The burden of demonstrating the excessive nature lies with the business (§ 1798.145(h)(3)).

## How to process each type of DSAR in practice

### Access and information request

Receive and authenticate the consumer's identity.

Locate all personal data collected about this consumer in the preceding 12 months across all systems.

Prepare a response covering: categories of data, categories of sources, purposes, categories of third parties, and the specific pieces of information.

If the business sold or shared data: list by category of data and category of third party (in separate lists for "sold/shared" and "disclosed for business purposes").

Deliver in a readily usable format that allows transmission from one entity to another without hindrance.

Send within the 45-day deadline.

### Deletion request

Receive and authenticate.

Check whether a legal exception allows retaining the data.

If no exception: delete from own records and notify service providers, contractors, and third parties to also delete.

Retain only the confidential record of the deletion request to prevent future resale.

Confirm to the consumer.

### Correction request

Receive and authenticate.

Identify which data is inaccurate and in which systems it is stored.

Use commercially reasonable efforts to correct as directed by the consumer.

Confirm the correction.

If the request is for correction of health information and the business rejects it as accurate, the consumer has the right to include an addendum of up to 250 words to the record.

### Opt-out of sale and sharing request

Receive the request (may be via "Do Not Sell or Share" link, via GPC, or via authorized representative).

Immediately cease sale and sharing of this consumer's data.

Do not request consent again for at least 12 months.

Notify any third parties that recently received the data about the opt-out.

### Request to limit use of sensitive personal information

Receive via "Limit the Use of My Sensitive Personal Information" link or other mechanism.

Cease use of the consumer's sensitive personal information for purposes beyond what is necessary to provide the products or services reasonably expected.

Notify service providers about the limitation so they also cease unauthorized uses.

## Protection against discrimination

§ 1798.125 expressly prohibits businesses from discriminating against consumers who exercise their rights. The business cannot:

Deny products or services.

Charge different prices or rates.

Provide different quality of goods or services.

Suggest the consumer will receive differential treatment.

Retaliate against employees, job applicants, or independent contractors who exercise their rights.

The exception is voluntary financial incentive programs. The business may offer financial compensation, discounts, or benefits in exchange for data use, as long as the consumer expressly consents and the incentives are not unjust, unreasonable, coercive, or abusive.

## Documentation and records

Every processed request must be documented. This includes:

Date and time of receipt.

Type of request.

Authentication process performed.

Action taken.

Date and form of response to the consumer.

In case of denial: recorded justification.

This documentation is what protects the business in a CPPA or Attorney General investigation.

## Shared enforcement: CPPA and Attorney General

The **California Privacy Protection Agency (CPPA)** has administrative power to:

Investigate businesses on its own initiative or based on complaints.

Impose fines of up to **US$ 2,500 per violation** and up to **US$ 7,500 for intentional violations** or violations involving minors.

The **California Attorney General** may seek civil penalties in the same amounts in a civil action.

There is no guaranteed cure period before CPPA actions. The agency decides by discretion whether and when to initiate an investigation.

## How AdOpt helps with the Privacy Portal

AdOpt logs every consent, opt-out, and sensitive information limitation interaction with a timestamp and unique identifier. When the consumer opts out of sale and sharing, the system automatically updates the corresponding trackers.

The GPC is honored automatically. AdOpt's auditable log serves as evidence of compliance. And when legislation changes, the platform updates automatically.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Want to build a Privacy Portal for your site that complies with the CCPA/CPRA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Checklist: what the Privacy Portal needs for the CCPA/CPRA

**Two or more submission methods**, including a toll-free telephone number (§ 1798.130(a)(1)).

**Website available** as a submission channel if the business maintains a website.

**Coverage of 6 rights**: access/know, deletion, correction, opt-out of sale/sharing, limit sensitive PI, and non-discrimination.

**12-month lookback** for access requests (§ 1798.130(a)(2)(B)).

**45-day response deadline**, with +45-day extension with notification (§ 1798.130(a)(2)(A)).

**Free service** limited to twice per consumer in 12 months (§ 1798.130(b)).

**Authentication process** proportionate to the nature of data, without requiring new account creation.

**Acceptance of requests from authorized representatives**, including parents of minors.

**"Do Not Sell or Share My Personal Information" link** on the site when there is sale or sharing.

**"Limit the Use of My Sensitive Personal Information" link** when applicable.

**GPC honored** when sent by the user.

**12-month waiting period** before requesting consent again after opt-out.

**Notification of third parties** for data deletion when a deletion request is fulfilled.

**Confidential record** of deletion requests to prevent resale.

**Documentation** of each request, action, and response.

## Comparison: Privacy Portal deadlines under the CCPA/CPRA

| Request type | Response deadline | Extension possible |
|---|---|---|
| Access/know, deletion, correction | 45 days | +45 days with notification |
| Opt-out of sale/sharing | Immediate after receipt | Does not apply |
| Limit use of sensitive PI | Immediate after receipt | Does not apply |
| Re-contact after opt-out | 12 months minimum | No extension |
| Pre-lawsuit notice (security breach) | 30 days for business to cure | No extension |

## FAQ: CCPA/CPRA and Privacy Portal

**1. Does the CCPA require a toll-free telephone number for the Privacy Portal?**
Yes. § 1798.130(a)(1) requires the business to provide two or more designated methods for submitting requests, including at minimum a toll-free telephone number. The exception applies to businesses that operate exclusively online with a direct consumer relationship, which may limit themselves to an email address. For most businesses with a website, the toll-free number is mandatory.

**2. What is the "12-month lookback" and how does it affect access requests?**
§ 1798.130(a)(2)(B) requires that the response to an access request cover the 12 months preceding receipt of the request. This means the Privacy Portal must be capable of retrieving data collected in the preceding 12 months from each request date, which requires appropriate tracking and retention systems.

**3. How many times per year must the business process DSARs free of charge?**
Twice in a 12-month period per consumer, under § 1798.130(b). For requests beyond this limit, or that are manifestly unfounded or repetitive, the business may charge a reasonable fee for administrative costs or decline, demonstrating the excessive nature.

**4. How does the private right of action under the CCPA work and what does it have to do with the Privacy Portal?**
§ 1798.150 grants the consumer the right to file a civil lawsuit for security data breaches. Before initiating action for statutory damages, the consumer must provide written notice 30 days in advance. The Privacy Portal should be the channel through which these notifications are received and processed. If the business cures within the period and provides an adequate written statement, no action may be initiated.

**5. Must the business notify third parties when it fulfills a deletion request?**
Yes. § 1798.105(c)(1) requires the business to notify any service provider or contractor to delete the data, and also notify all third parties to whom the data was sold or shared, unless impossible or involving disproportionate effort. The business may also maintain a confidential record of the deletion request solely to ensure that the data of the consumer who requested deletion is not resold.

[Ready to build a Privacy Portal for your site that complies with the CCPA/CPRA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)


California CCPA: DSAR Privacy Portal

A California resident visits your site, consumes your content, and at some point decides to exercise the rights the law guarantees. They want to know what you have about them. They want to correct inaccurate information. They want you to stop sharing their data with advertising networks.

This page covers one piece of the picture. For the full scope of the CPRA — who must comply, the thresholds, the consumer rights and the penalties — start with our [complete guide to the CPRA and cookies](https://goadopt.io/en/blog/california-cpra-and-cookies-all-you-need-to-know/).

What happens next?

The California Privacy Rights Act (CPRA) defines precisely what must happen: the channel for receiving the request, the response deadlines, what is free and what is not, and what happens when the business does not comply.

The major additions compared to the original CCPA: the right to correct data, the right to limit use of sensitive personal information, and automatic tripled penalties for violations involving consumers under 16.

This article covers everything.

## What is a DSAR under the CPRA?

DSAR stands for Data Subject Access Request. It is any formal request from a California consumer to exercise the rights the CPRA guarantees over their own data.

Under Civil Code § 1798.130, consumers exercise their rights through means established by the business and described in the privacy policy.

If you already know the [LGPD data subject portal](https://goadopt.io/en/blog/lgpd-cookies-all-you-need-to-know/), the logic is familiar. The CPRA adds new rights and strengthens protections for minors.

## What are consumer rights under the CPRA?

Under Civil Code § 1798.100 through § 1798.125, California residents have the following rights:

### Right to know

The consumer may request that the business disclose:

The categories of personal information collected about them.

The specific categories of sources from which information was collected.

The business or commercial purpose for collecting, selling, or sharing the information.

The categories of third parties to which the business discloses information.

The specific pieces of personal information collected about the consumer.

### Right to access

The consumer may obtain a copy of the specific personal information the business has collected in the past 12 months (Civil Code § 1798.100(a)).

### Right to deletion

The consumer may request deletion of their personal information, with some exceptions (Civil Code § 1798.105). Exceptions include: completing the transaction, security, debugging, internal research, and legal compliance.

### Right to correct

This is a new right the CCPA did not have (Civil Code § 1798.106). The consumer may request that the business correct inaccurate personal information it maintains about them, taking into account the nature of the information and the purposes of processing.

### Right to portability

The consumer may obtain personal information in a portable, usable format (Civil Code § 1798.100(a)).

### Right to opt-out of selling and sharing

The consumer may refuse the selling of personal information and the sharing for cross-context behavioral advertising (Civil Code § 1798.120). This right is exercised via the "Do Not Sell or Share My Personal Information" link.

### Right to limit SPI use

This is another new right from the CPRA (Civil Code § 1798.121). The consumer may limit use and disclosure of their sensitive personal information to essential purposes: providing the requested product or service, security and integrity, and legal compliance. This right is exercised via the "Limit the Use of My Sensitive Personal Information" link.

### Right to non-discrimination

The business cannot discriminate against consumers who exercise their rights, including denying products, charging different prices, or offering lower quality (Civil Code § 1798.125).

## What are the response deadlines?

Under Civil Code § 1798.130(a)(2):

**45 days** to respond from receipt of the verified request.

Extension of **+45 days** when reasonably necessary, with consumer notification within the initial period.

**Free up to 2 times per year** per consumer. For a third or subsequent request within the same 12-month period, the business may charge a reasonable fee.

The 45-day deadline applies to know/access, deletion, correction, and portability requests, and for confirmation that opt-outs and limitations have been applied.

## The opt-out process: no unnecessary barriers

The CPRA is explicit: the business cannot require the consumer to create an account or go through more than two steps to exercise the opt-out of selling and sharing (Civil Code § 1798.120(c)).

The opt-out process must:

Be direct and accessible via the "Do Not Sell or Share My Personal Information" link.

Not require creation of a new account.

Not involve more than two steps to opt-out confirmation.

Honor the Global Privacy Control (GPC) as a valid form of opt-out.

Be free of charge.

## The request process: reasonable authentication

For access, deletion, correction, and portability requests, the business may verify the consumer's identity using methods reasonably designed to verify that the requesting person is the consumer about whom data was collected (Civil Code § 1798.130(a)(2)).

Verification must be proportionate to the type of data involved. For low-risk data, email confirmation may be sufficient. For more sensitive data, a second verification factor may be justified.

What is never acceptable: requiring more information than necessary to verify identity, or creating deliberately burdensome processes to discourage requests.

The business cannot require the consumer to provide their password to exercise their rights.

## Authorized agents

The consumer may designate an authorized agent to submit requests on their behalf (Civil Code § 1798.130(a)(2)(C)).

For opt-out requests: the business must respect the agent's request if the consumer has provided the agent with signed written permission, or upon reasonable verification of both the consumer's identity and the agent's authority.

The Global Privacy Control (GPC) functions as a form of technological authorized agent: by activating the GPC, the consumer is designating their browser configuration as an agent to transmit the opt-out.

## What happens when the business denies a request?

The business may deny when:

It cannot verify the consumer's identity.

The request applies to information collected before January 2022 (for CPRA enforcement, except for the right to access).

There is a legal exception justifying retention.

In all cases, the denial must be communicated to the consumer, with:

Justification for the denial.

Information on how to contact the CPPA to submit a complaint.

## Special protection for minors under 16

The CPRA has specific rules for minors that directly affect the Privacy Portal.

For consumers under 16, the business cannot sell or share personal information without active opt-in. If the business receives a DSAR related to opt-out from a consumer under 16, that is moot because opt-in should never have occurred without permission.

If a consumer under 16 declined or revoked opt-in, the business must wait 12 months before requesting consent again for selling or sharing.

For consumers under 13, consent was given by parents or guardians. DSARs from consumers under 13 must be processed in coordination with parents or legal guardians.

Penalties for violations involving data of consumers under 16 are tripled and automatic: up to **US$ 7,500 per violation**, without needing to prove intent.

## The private right of action: the CPRA differentiator

The CPRA preserves and expands the private right of action that the CCPA introduced. This is a key differentiator from other US state laws like the VCDPA, OCPA, and CTDPA, which have no private right of action.

Consumers can sue the business directly when there is an unauthorized data security breach resulting in unauthorized access, theft, disclosure, use, modification, or destruction of unencrypted, unredacted personal information in specified categories.

Minimum damages are **US$ 100 to US$ 750 per consumer per incident**, or actual damages, whichever is greater. Class actions are permitted.

## Protection against discrimination

Civil Code § 1798.125 prohibits discriminating against consumers who exercise their rights, including denying goods or services, charging different prices, or offering different quality.

The exception is loyalty, rewards, premium features, or discount programs where the difference is reasonably related to the value the business derives from the data, provided the consumer participates voluntarily.

## Documentation and records

Each processed request must be documented. This includes:

Date and time of receipt.

Type of request and right exercised.

Identity verification process conducted.

Action taken (fulfilled, denied, or alternative adopted).

Date and form of response to the consumer.

If denied: justification recorded.

This documentation is what protects the business during a CPPA investigation.

## How AdOpt helps with the Privacy Portal

AdOpt records every consent, opt-out from selling and sharing, and SPI use limitation interaction, with a timestamp and unique identifier. When the consumer opts out via the site link or via the GPC, the system automatically updates the corresponding trackers.

AdOpt's auditable log serves as evidence of compliance for the CPPA. And when the law changes, the platform updates automatically.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Want to build a Privacy Portal for your site that complies with the CPRA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Checklist: what the Privacy Portal needs for the CPRA

**Request submission channel** described in the privacy policy (Civil Code § 1798.130).

**"Do Not Sell or Share My Personal Information"** link visible on homepage and collection pages (Civil Code § 1798.120).

**"Limit the Use of My Sensitive Personal Information"** link if SPI is collected (Civil Code § 1798.121).

**GPC honored** as a valid form of opt-out from selling and sharing.

**Coverage of all rights**: know, access, deletion, correction, portability, opt-out from selling/sharing, SPI limitation, non-discrimination.

**Right to correct** described with process and 45-day deadline (Civil Code § 1798.106).

**Right to limit SPI** described with process and 45-day deadline (Civil Code § 1798.121).

**Opt-out without unnecessary multiple steps** (maximum 2 steps to confirmation).

**Authorized agents** accepted for request submission (Civil Code § 1798.130 a(2)(C)).

**Deadlines**: 45 days to respond (+45 ext.); reasonable period for appeals.

**Free service** for up to 2 requests per consumer per year (Civil Code § 1798.130 a(3)).

**Documented record** of each request, action taken, and response sent.

**Protection for consumers under 16**: mandatory opt-in for selling/sharing.

**12-month waiting rule** after consumers under 16 decline consent.

**Information about CPPA** for submitting complaints after denials.

## Comparative: Privacy Portal deadlines under the CPRA

| Request type | Response deadline | Extension possible |
|---|---|---|
| Know, access, deletion, correction, portability | 45 days | +45 days with notification |
| Opt-out of selling and sharing | No specific deadline | Immediate recommended |
| Limit SPI use | No specific deadline | Immediate recommended |
| Free service per year | 2 times per consumer | Reasonable fee from 3rd request |

## FAQ: CPRA and Privacy Portal

**1. What is the new right to correct data under the CPRA and how must the Privacy Portal accommodate it?**
The right to correction (Civil Code § 1798.106) was added by the CPRA and did not exist under the CCPA. It allows consumers to request correction of inaccurate personal information maintained by the business. The Privacy Portal must have a specific option to request data correction, describe the verification and correction process, and respond within 45 days informing whether the correction was made or justifying why it was not possible. The business may maintain original data if it believes it is accurate, but must document the correction request and communicate the outcome to the consumer.

**2. How does the right to limit use of sensitive personal information (SPI) work?**
The right to SPI limitation (Civil Code § 1798.121) allows consumers to instruct the business to limit use of their sensitive personal information to essential purposes: providing the requested product or service, security, debugging, internal research, and compliance. The Privacy Portal must have a mechanism to receive this request, or the business must provide the "Limit the Use of My Sensitive Personal Information" link that leads to a page where this right can be exercised without multiple steps.

**3. Why is the GPC a valid form of opt-out under the CPRA?**
The CPPA confirmed in its guidance that the Global Privacy Control (GPC) is a valid technological form of opt-out from selling and sharing personal information under the CPRA. By activating the GPC, the consumer is automatically instructing each site visited not to sell or share their data. Ignoring the GPC when a visitor has it enabled is equivalent to ignoring an explicit opt-out, which constitutes a CPRA violation. A properly configured CMP detects the GPC and automatically blocks advertising trackers for visitors who have it enabled.

**4. Does the CPRA have an appeal process for consumers whose requests were denied?**
The CPRA does not have a formal structured appeal process like the OCPA and CTDPA. When the business denies a request, it must inform the consumer that they can submit a complaint to the California Privacy Protection Agency (CPPA). The CPPA complaint process is the primary avenue of recourse for consumers whose requests were denied without adequate justification.

**5. How should the Privacy Portal handle requests from parents on behalf of minor children?**
For consumers under 13, parents or legal guardians are the holders of the consent right. A DSAR submitted by a parent on behalf of a child under 13 must be processed the same way as a request from the consumer themselves, after reasonable verification of the parent/guardian relationship. For teenagers aged 13 to 15, the business may require the teenager themselves to submit the request, since the law recognizes teenagers' ability to exercise their own rights, while opt-in for selling/sharing remains required.

[Ready to build a Privacy Portal for your site that complies with the CPRA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)
