Tired of the ads from that site you visited following you around?
Is your computer running slow when accessing a particular website?
Want to delete all cookies from a specific service or site?

One of the alternatives is to **delete Cookies and Cache from your browsers!**
We'll provide you with step-by-step instructions for each of these options. But before that, to make things clear:

## What is cache?

The term cache is basically the storage of frequently used data or processes, which are stored for faster future access, thus saving time and unnecessary use of hardware processing.

This functionality is widely used in various types of devices and software, such as browsers, for example. You know when you first access a website and it takes longer to load than your favorite site that you visit every day?

That's precisely the practical application of cache! Your browser has saved various information and page structures in a reserved environment so that you don't have to download them again on future visits. This makes everything faster, especially for those with weaker internet or weak signals.

## What are cookies?

In short, cookies serve the same function as cache in terms of storing information, but in different formats and processes. Many of the services we access daily use cookies for other functionalities such as remembering your browser as a returning client, keeping items you "left in the shopping cart," recording information about your browsing, etc.

In this [article](https://goadopt.io/en/blog/lgpd-cookies-all-you-need-to-know/), you can find a more in-depth explanation.

In other words, both cookies and cache store information in your computer's or mobile device's memory. As a result, they often overload the storage and slow down the system. That's why various browsers have rules to delete all cookies every three months, for example, or are starting to block third-party cookies to avoid this unnecessary accumulation.

However, sometimes the browser's cleaning cycle is not enough.
So learn from [AdOpt](https://goadopt.io/) how to delete your browser's cache and cookies:

## How to quickly delete cookies and cache?

Sometimes, when you're experiencing issues with using an online service or accessing a website, the technical team asks you to clear the browser cache.

To get rid of the data stored on your computer when you access a website, you don't need to go to the Google Chrome Preferences. Just use the shortcut below:

### On Windows
Control + Shift + Del

Command + Shift + Del

After that, simply select the items you want to delete: cache, cookies, history... and DONE!

![clear_cookies_cache_chrome.png](https://strapi.goadopt.io/uploads/clear_cookies_cache_chrome_32fa1b37f4.png)

## Delete Cookies in Chrome

If you're using Google Chrome,

1. Click on the **three dots in the upper right corner** to open a configuration menu.
2. Go to **More Tools**.
3. Then click on **Clear browsing data**. A new window, as shown in the image below, will open, and in it, you just need to choose what you want to clear: - **Cookies and other site data - Cached images and files**.
4. **After selecting the options, click the "Clear browsing data" button.**

**Done!**

Then click on Clear browsing data. A new window, as shown in the image below, will open, and in it, you just need to choose what you want to clear: - Cookies and other site data - Cached images and files.

After selecting the options, click the "Clear browsing data" button.

Done!

By following these instructions, your computer will be lighter, and your browsing experience will improve.
**But be prepared because all saved logins and access will also be cleared, requiring you to sign in again and "prove that you are you."**

## Clearing Cookies in Internet Explorer

If your browser is **Internet Explorer**, for any version, follow the steps below:

1. Access the menu on the right **Settings** (indicated by the gear icon as shown below).
2. Click on **Security > Delete browsing history.** (A window will open, showing your browsing history).
3. By clicking the **Delete** button, you can delete all the data saved by the **Internet Explorer **browser.

### Clearing Cookies in Mozilla Firefox
For versions of the **Mozilla Firefox **browser, follow the simple cleaning process below:

1. Menu **Firefox > Preferences**.
2. Choose the **Privacy** option.
3. Select the option **Clear your recent history**: *Here, you can determine **the time period** to be deleted and the respective details to select.
4. To finish, simply click **Clear Now.**
5. **Done**! You can now continue browsing peacefully!

## Clearing Cookies in Safari
For Safari users, the process to clear cookies is also straightforward.

Click on the **Preferences** option.
Select the **Privacy** option > **Remove all website data.**
After this click, confirm your decision.


How to delete cookies and cache in Chrome and other browsers?

João Bruno Soares

Terms of use are an essential part of many websites, especially regarding [LGPD](https://goadopt.io/en/blog/lgpd-general-data-protection-law/). Despite being frequently overlooked, Terms of Use are, quite literally, the contract established between you and the company offering that product or service in a digital manner. Therefore, not only their development but also any eventual changes require careful consideration.

This care pertains to both the situations in which such changes can or should be applied and the manner of alteration and its consequences. In the following text, you'll find an explanation of how each of these aspects works and how to ensure the validity of your terms, as well as compliance with [LGPD, GDPR, CCPA, PIPEDA, POPIA](https://goadopt.io), among others.

## What Are the Key Topics Addressed in Terms of Use?

Before delving into why and how to make changes to the Terms of Use, let's first briefly review some of the main chapters/topics typically found in any standard document.

Based on AdOpt's own [Terms of Use](https://goadopt.io/en/blog/terms-of-use-lgpd/), the text is divided as follows:

### 1. Object

### 2. Features

### 3. Contracting and Service Provision

### 4. Term

### 5. Remuneration

### 6. Service Interruption

### 7. Responsibilities

### 8. Processing of Personal Data

Here's a brief summary of what each section covers:

1. **Object**: Identification of the involved parties and detailed description of the services provided, including their characteristics and operational definitions.

2. **Features**: In the case of software like AdOpt's, this section lists the features involved and provides detailed information within the plans.

3. **Contracting and Service Provision**: Description of the processes and necessary details for service contracting.

4. **Term**: Delivery frequency and/or product/service availability after/during purchase.

5. **Remuneration**: Explanation of how payments will be made, including pricing, payment deadlines, and conditions.

6. **Service Interruption**: Explanation of situations where service interruption is prescribed, necessary, and justified, as well as the events that may lead to interruption.

7. **Responsibilities**: Clarification of the responsibilities of both parties upon accepting the terms. On one side, the provider commits to providing the service, and the customer commits to making payments and using the system/platform as necessary for service delivery.

8. **Processing of Personal Data**: Definition of the roles of [data controller vs. data processor](https://goadopt.io/en/blog/differences-data-controller-data-processor/) within the processes established by the contract. If data is collected, the legal basis used is specified, along with the responsibilities arising from the operation.

9. **General Provisions**: Declarations that position the contract geographically, establish conditions for possible updates, provide guidance in case one of the parties breaches the contract, and specify the jurisdiction.

## Why Change the Terms of Use?

Changes to these documents, although often overlooked, are necessary whenever there is a significant alteration in the content description. Aspects such as the nature of the service or product delivered by the company, conditions of public service, official data, and now, mandatory aspects under LGPD, all necessitate changes.

Both [LGPD (General Data Protection Law)](https://goadopt.io/en/blog/lgpd-general-data-protection-law/) and other applicable regulations specify aspects related to data collection, processing, and treatment that may be part of the service or product and, therefore, must be included in the terms of use.

Furthermore, changes are often required to align the content of the terms of use with the reality of the brand. After all, these terms should reflect the company's actual situation and not be a work of fiction.

Otherwise, there's a risk of non-compatibility between the website's terms of use and its reality, services, rules, and regulations that apply to it. In essence, it renders the terms useless.

Aspects of our lives are constantly changing, and this is also true when it comes to brands, how they operate, and the rules they are subject to.

Since the terms of use relate to these matters, any changes in them should also reflect on them to ensure they remain valid and relevant, fulfilling their role in relation to the brand.

## When Is It Necessary to Change the Terms of Use?

In general terms, changes should be made whenever one of these aspects is identified:

- Alteration in the site's mode of operation.
- Addition or modification of available services and products.
- Legal changes affecting the rules a site can apply, as well as the duties and rights it imposes.
- Inadequacy between the terms and the reality of the brand (such as its characteristics, offerings, and operations), or between the terms and current laws (such as LGPD or the Consumer Code, for example).

Therefore, there are various reasons that can lead to changes in the terms of use. All of them are relevant, especially to maintain the validity of this document and its applicability.

## Do I Need Authorization to Change the Terms of Use?

Yes! The terms are among the documents that clarify to the public what the rules are in that space, meaning on the website.

They join the [privacy policy](https://goadopt.io/en/blog/ideal-privacy-policy/) and the cookie notice to promote transparency with the user. While the terms indicate the applicable rules, rights, and duties, the policy pertains to privacy and data usage, which cookies are also part of.

All these documents are important because they assist in complying with LGPD regulations. Transparency is at its core.

Therefore, it wouldn't make sense for changes to the terms of use to occur without the consent of the user, right? It's not necessarily about authorization; after all, it's up to the user to decide whether to accept the terms, thereby maintaining access to the site's services and making their information available or to forfeit this and withdraw their consent.

In conclusion: whenever there are changes in rules and policies that affect users and data subjects, they must be notified to express their acceptance or rejection of the new rules and guidelines.

That's why changes are always announced for a future date, giving users ample time to read and understand the changes.

## My terms of use include a clause indicating the possibility of changing them, do I still need to notify users?

Once again, the answer is yes. Despite many terms and policies including the possibility of changes, it's not a good idea to change them without any notification and obtaining the consent of the data subject.

After all, this would be a unilateral change. Since terms of use function as an online contract, this isn't a favorable decision and can be seen as abusive. Likewise, it goes against LGPD, where transparency and consent are essential.

## How to Notify Your Users of Changes to the Terms of Use?

It's essential that you inform your users and customers of changes to your privacy policies and terms. Here are some tips on how to do it effectively.

## Notification by Message

One of the ways to notify your users of changes to the terms of use on your website is through message notifications. In this case, you can opt for email or other communication methods provided by the data subject (SMS, etc.).

In this scenario, inform users about the changes and provide access to the new terms. Similarly, ensure that when users access the document, they have the opportunity to indicate whether they accept these changes (in the famous "I declare that I have read and accept the terms of use" checkbox).

Additionally, make sure that this type of consent for changes is identifiable and properly archived as evidence.

## Notification upon Website Access

Another option is to have a banner that indicates changes to the terms of use appear as soon as the user accesses your website. In this scenario, it's advisable to prevent the user from navigating the page until they have read and agreed (or disagreed) with the new terms.

This practice is typically used when the new terms are already in effect, as it can have a more significant impact on the user experience. However, it's essential for both scenarios.

## Beware! Silence Does Not Imply Consent

Lastly, our final tip when changing the terms of use is to be careful regarding silence. Unlike what we often assume, silence does not imply consent. It's essential to obtain explicit consent from the data subject regarding changes to the terms.

## Help the Visitor Read the New Terms of Use!

Not all of your visitors, if not the minority, have the patience and interest to read your Terms of Use. Yes, this is concerning given its importance, but it's a fact we observe daily.

So, since you'll already have to notify users of changes, a good practice is to highlight the main changes and how they might affect the user so they can quickly grasp the key points, accelerating their understanding and, consequently, the collection of their acceptance of the terms.

So, since you'll already have to notify users of changes, a good practice is to highlight the main changes and how they might affect the user so they can quickly grasp the key points, accelerating their understanding and, consequently, the collection of their acceptance of the terms.

Do you have any questions or work as a [Data Protection Officer](https://goadopt.io/en/blog/responsibilities-of-a-data-protection-officer/) and can contribute with these tips?

Please let us know how we can improve; we're always open to feedback!


Tips on how to notify users after a change on the Terms of Use.

When the California Consumer Privacy Act (CCPA) came into effect on January 1, 2020, the United States still had no federal privacy law. California decided not to wait and passed the most comprehensive data protection law in the country, which became the reference for virtually everything that followed.

Two years later, California voters went to the polls and approved Proposition 24, which created the California Privacy Rights Act (CPRA). And this is where things get a little confusing for outsiders.

This guide explains what each one is, what changed, and what the current California law requires from anyone handling data of state consumers.

## CCPA and CPRA: the same law or different laws?

Good question, and the answer is not simple.

The **CCPA** (California Consumer Privacy Act) is the original law. It was passed as AB 375 in 2018 and came into effect on January 1, 2020. It is codified at California Civil Code § 1798.100 to § 1798.199.100.

The **CPRA** (California Privacy Rights Act) is Proposition 24, passed by popular vote on November 3, 2020, with most provisions operative starting January 1, 2023. The CPRA did not create a separate law. It **amended and expanded** the CCPA. In other words: what exists today is the CCPA with the CPRA amendments incorporated.

### What the CCPA had originally

The 2020 CCPA guaranteed California consumers basic rights: knowing what was collected, requesting deletion of their data, and refusing the sale of their data. It was a pioneering and important law, but with significant gaps.

### What the CPRA changed starting in 2023

The CPRA made deep changes:

**Created the California Privacy Protection Agency (CPPA):** an independent regulatory agency with full administrative power to implement and enforce the law. Before, it was the Attorney General who enforced compliance. Now the CPPA has its own structure, investigative powers, authority to impose administrative fines, and a guaranteed budget.

**Added new rights:** the right to correct inaccurate data and the right to limit the use and disclosure of sensitive personal information.

**Created the "sharing" category:** separated "sale" from "sharing" for cross-context behavioral advertising. This means sharing data with advertising platforms for targeting, even without receiving money directly, now requires an opt-out.

**Expanded the definition of sensitive data:** added genetic data, neural data, health information, sexual orientation, and sex life.

**Required the "Limit the Use of My Sensitive Personal Information" link:** in addition to the existing "Do Not Sell or Share My Personal Information."

**Imposed data minimization and proportionate retention requirements.**

| Aspect | CCPA (2020) | CCPA + CPRA (2023) |
|---|---|---|
| Enforcement | Attorney General | CPPA (independent agency) + AG |
| Consumer rights | 5 rights | 7 rights |
| Required links | "Do Not Sell My Personal Information" | "Do Not Sell or Share" + "Limit Sensitive PI" |
| Sensitive data | Basic category | Expanded (includes neural data) |
| Private right of action | Security breaches only | Security breaches only |
| Full effect | Jan 2020 | Jan 2023 |

In the California articles on this blog, we cover the current law: **CCPA as amended by the CPRA**. For the specific CPRA changes, we have a dedicated guide on the [California CPRA](https://goadopt.io/en/blog/california-cpra-and-cookies-all-you-need-to-know/).

## What is the CCPA/CPRA today?

The California Consumer Privacy Act, as amended by the CPRA, is the most comprehensive data protection law in the United States. It guarantees broad rights to California consumers and creates detailed obligations for businesses that handle their data.

Enforcement today is shared between the **California Privacy Protection Agency (CPPA)** and the **California Attorney General**, with distinct and complementary powers.

## When did the CCPA come into effect?

The original CCPA came into effect on **January 1, 2020**.

The CPRA amendments became operative on **January 1, 2023**.

The current version of the law, with all rights and obligations in effect, has applied since January 2023.

## Who needs to comply with the CCPA?

Under § 1798.140(d), the law applies to for-profit businesses that do business in California, collect personal information from consumers, and meet at least **one** of the following thresholds:

Annual gross revenues in excess of **US$ 25 million** in the preceding calendar year.

Annually buys, sells, or shares the personal information of **100,000 or more consumers or households**.

Derives **50% or more** of annual revenues from selling or sharing consumers' personal information.

The US$ 25 million threshold is the lowest among all US state privacy laws, making the CCPA the law with the broadest reach in terms of businesses affected.

Understanding the distinction between [controller and processor](https://goadopt.io/en/blog/responsibilities-of-a-data-protection-officer/) is fundamental to defining responsibilities in the processing chain.

### CCPA Exemptions

Exempt from most obligations:

Protected health information under HIPAA and data of covered entities.

Data regulated by the California Confidentiality of Medical Information Act.

Consumer credit information regulated by the Fair Credit Reporting Act.

Financial data regulated by the Gramm-Leach-Bliley Act or the California Financial Information Privacy Act.

Data regulated by the Driver's Privacy Protection Act.

Academic or public health research data with appropriate safeguards.

Employee and job applicant data when used in that capacity.

## What is personal information under the CCPA?

Under § 1798.140(v), personal information is any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.

This includes identifiers such as name, address, IP address, email, Social Security number, driver's license, and passport number. It also includes commercial information, browsing history, geolocation data, audio and visual information, employment data, education data, and inferences drawn to create consumer profiles.

De-identified data and publicly available information are excluded.

## What is sensitive personal information under the CCPA/CPRA?

The CCPA, after CPRA amendments, has an expanded category of "sensitive personal information" (§ 1798.140(ae)):

Social Security number, driver's license, state identification card, or passport number.

Account login, financial account, debit or credit card number in combination with any required security code or password.

Precise geolocation (radius of 1,850 feet or less).

Racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, or union membership.

Contents of a consumer's mail, email, and text messages, unless the business is the intended recipient.

Genetic data.

Neural data: information generated by measuring the activity of a consumer's central or peripheral nervous system.

Processing of biometric information for unique identification.

Health information collected and analyzed.

Information about sex life or sexual orientation.

The inclusion of neural data is exclusive to the CCPA/CPRA among US state privacy laws.

## What are consumer rights under the CCPA/CPRA?

The law guarantees seven main rights:

**Right to know and access:** confirming whether the business processes their data and obtaining specific information collected, including categories of data, sources, purposes, third parties, and the specific pieces of personal information. The request covers the **preceding 12 months** (§ 1798.110, 1798.115).

**Right to deletion:** requesting deletion of personal data collected by the business, with the obligation to notify service providers, contractors, and third parties to also delete (§ 1798.105).

**Right to correction:** requesting correction of inaccurate personal data, added by the CPRA (§ 1798.106).

**Right to opt-out of sale and sharing:** directing the business not to sell or share personal data, exercisable at any time (§ 1798.120).

**Right to limit use of sensitive personal information:** restricting use of sensitive personal information to what is necessary to provide the products or services reasonably expected. Added by the CPRA (§ 1798.121).

**Right of non-discrimination:** exercising any right without being discriminated against by the business (§ 1798.125).

**Private right of action for security breaches:** filing a civil lawsuit for damages of US$ 100 to US$ 750 per consumer per incident. Unique among US state privacy laws (§ 1798.150).

The business has **45 days** to respond. The deadline can be extended by another **45 days** when reasonably necessary, with notification within the initial period. Service is free. The business is not obligated to provide information to the same consumer more than **twice in a 12-month period** (§ 1798.130(b)).

## The two required links on the site

The CCPA/CPRA requires specific links on the business's homepage (§ 1798.135):

**"Do Not Sell or Share My Personal Information":** a clear and conspicuous link to a page where the consumer can opt out of sale and sharing of their data.

**"Limit the Use of My Sensitive Personal Information":** a link allowing the consumer to limit the use of sensitive personal information to what is necessary to provide the products or services.

The business may use a single combined link for both purposes, as long as it clearly allows exercising both options.

Both links need somewhere to land. In practice that destination is a [privacy portal where the consumer submits and tracks the request](https://goadopt.io/en/blog/california-ccpa-dsar-privacy-portal/) — the same channel that receives access, deletion, and correction requests within the statutory deadline.

It is also possible to comply by honoring the opt-out preference signal of the **Global Privacy Control (GPC)** when sent by the user.

## "Sale" vs "sharing" under the CCPA/CPRA

This distinction created by the CPRA is fundamental.

**Sale** (§ 1798.140(ad)): transfer of data for monetary or **other valuable consideration** to third parties.

**Sharing** (§ 1798.140(ah)): transfer of data to third parties for **cross-context behavioral advertising**, whether or not for monetary consideration.

Cross-context behavioral advertising (§ 1798.140(k)): targeting ads based on personal information obtained from consumer activity across businesses, distinctly branded websites, applications, or services other than where the consumer is currently interacting.

In practice: if your site passes data to an advertising platform so it can display personalized ads to the user on other sites, that is "sharing" under the CCPA/CPRA, even if you receive no money directly.

## Cookies and the CCPA/CPRA

Cookies that collect personal information or allow user identification fall directly within the scope of the CCPA/CPRA.

Before firing any non-essential cookie, the site must display a clear [cookie notice](https://goadopt.io/en/blog/operation-of-cookie-banner/), offer opt-out of sale and sharing, block non-consented trackers, and honor the GPC.

[Correct tag categorization](https://goadopt.io/en/blog/difference-cookies-local-storage-session-storage/) is what makes it possible to identify which cookies constitute sale or sharing and which require the opt-out links.

That same inventory is what you publish to visitors: a [CCPA cookie policy](https://goadopt.io/en/blog/california-ccpa-cookies-policy/) needs to list each category of tracker, its purpose, its retention period, and whether it results in sale or sharing of personal information.

## Protection for consumers under 16 years of age

§ 1798.120(c) prohibits the sale or sharing of data of consumers under 16 without affirmative authorization:

For consumers between 13 and 15: the consumer's own authorization.

For consumers under 13: authorization from a parent or legal guardian.

A business that willfully disregards the consumer's age is deemed to have actual knowledge of it.

## The California Privacy Protection Agency (CPPA)

The CPPA (§ 1798.199.10) is governed by a five-member board with terms of up to eight years. It has power to:

Impose administrative fines of up to **US$ 2,500 per violation** and up to **US$ 7,500 for intentional violations** or violations involving minors.

Investigate businesses on its own initiative or based on complaints.

Conduct audits.

Issue and revoke regulations.

The Attorney General retains power to seek **civil penalties** of up to US$ 2,500 per violation and US$ 7,500 for intentional violations or violations involving minors.

There is no guaranteed cure period before CPPA actions. The agency has discretion to investigate and act without any obligation to grant advance notice.

## The toll-free number is mandatory

§ 1798.130(a)(1) requires two or more designated methods for submitting requests. One of those methods must be, at minimum, a **toll-free telephone number**.

Businesses that operate exclusively online with a direct consumer relationship may limit themselves to an email address.

## Privacy notice: update every 12 months

§ 1798.130(a)(5) requires the business to update the privacy notice **at least once every 12 months**, including lists of the categories of data collected, sold, shared, and disclosed for business purposes in the preceding 12 months.

This is the annual review that keeps a [CCPA privacy policy](https://goadopt.io/en/blog/california-ccpa-privacy-policy/) valid — an outdated notice is, in practice, a notice out of compliance.

## How AdOpt helps with the CCPA/CPRA

AdOpt records every consent and opt-out interaction, honors the GPC when sent by the user, blocks trackers before acceptance, and generates the auditable log needed in a CPPA or Attorney General investigation.

The automatic scan identifies all active [trackers](https://goadopt.io/en/blog/gdpr-cookies-explained/) on the site, feeding the data inventory. And when the law changes, the platform updates automatically.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Ready to bring your website into compliance with the CCPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Comparing CCPA/CPRA with other privacy laws

| Law | State | Threshold | Penalty | Enforcer | Effective Date |
|---|---|---|---|---|---|
| CCPA/CPRA | California | US$ 25M OR 100K consumers OR 50% revenue | Up to US$ 7,500/violation | CPPA + AG | Jan 2020/Jan 2023 |
| VCDPA | Virginia | 100K or 25K + 50% revenue | Up to US$ 7,500/violation | AG | Jan 2023 |
| FDBR | Florida | US$ 1B+ global revenue | Up to US$ 50K/violation | Dept. Legal Affairs | Jul 2024 |
| NHDPA | New Hampshire | 35K or 10K + 25% revenue | Up to US$ 10K/violation | AG | Jan 2025 |
| CPA | Colorado | 100K or 25K + 50% revenue | Up to US$ 20K/violation | AG | Jul 2023 |

To understand how these [privacy laws](https://goadopt.io/en/blog/gdpr-lgpd-and-ccpa-what-are-these-laws-similarities-and-differences/) compare in structure and practical impact, our comparative guide goes deeper.

## Continue learning about privacy in California

The CCPA is the starting point, not the whole picture. To see what changed when Proposition 24 took effect, read our guide to the [CPRA and cookies](https://goadopt.io/en/blog/california-cpra-and-cookies-all-you-need-to-know/). And to compare California's approach with the European and Brazilian models, see [how the GDPR, LGPD, and CCPA differ in practice](https://goadopt.io/en/blog/gdpr-lgpd-and-ccpa-what-are-these-laws-similarities-and-differences/).

## The CCPA in practice: the three documents

Compliance with the CCPA rests on three documents that have to agree with each other: the [cookies policy](https://goadopt.io/en/blog/california-ccpa-cookies-policy/), which declares every tracker and its purpose; the [privacy policy](https://goadopt.io/en/blog/california-ccpa-privacy-policy/), which explains what you do with the data; and the [privacy portal](https://goadopt.io/en/blog/california-ccpa-dsar-privacy-portal/), where the consumer exercises their rights and you keep the record of it.

## FAQ: California CCPA/CPRA

**1. What is the difference between the CCPA and the CPRA?**
The CCPA is California's original privacy law, in effect since January 1, 2020. The CPRA (Proposition 24) was passed by voters in November 2020 and amended the CCPA with full effect from January 2023. The CPRA is not a separate law: it modified and expanded the CCPA. The most important changes were the creation of the California Privacy Protection Agency (CPPA), the addition of rights to correct data and limit use of sensitive personal information, the separation of "sale" from "sharing," and the expanded definition of sensitive personal information.

**2. Who needs to comply with the CCPA?**
For-profit businesses that do business in California and meet at least one threshold: annual revenues exceeding US$ 25 million; buying, selling, or sharing personal information of 100,000 or more consumers or households per year; or deriving 50% or more of annual revenues from selling or sharing personal data (§ 1798.140(d)).

**3. What is the difference between "sale" and "sharing" under the CCPA/CPRA?**
"Sale" is the transfer of data for monetary or other valuable consideration to third parties. "Sharing" is the transfer for cross-context behavioral advertising, with or without monetary consideration. The distinction ensures that advertising targeting practices are also subject to opt-out, even without direct payment to the site.

**4. What are the "Do Not Sell or Share" and "Limit the Use of My Sensitive Personal Information" links?**
These are mandatory links on the business's homepage (§ 1798.135). The first allows the consumer to opt out of sale and sharing of their data. The second allows limiting the use of sensitive personal information. They can be two separate links or a single combined link that clearly allows exercising both options.

**5. What is the private right of action under the CCPA and why is it unique?**
§ 1798.150 grants consumers the right to file a civil lawsuit when unencrypted and unredacted data is exposed in a security breach due to the business's failure to implement reasonable security measures. The consumer can recover US$ 100 to US$ 750 per incident or actual damages when greater. This private right of action is exclusive to the CCPA among US state privacy laws.

[Ready to bring your website into compliance with the CCPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)


All posts

How to delete cookies and cache in Chrome and other browsers?

Tips on how to notify users after a change on the Terms of Use.

California CCPA and Cookies: All You Need to Know