CPRA Privacy Management for Websites

The CCPA created California’s main consumer privacy framework. The CPRA expanded that framework in several areas:

• The right to opt out now covers both sale and sharing

• Consumers can request correction of inaccurate information

• Certain uses of sensitive personal information can be limited

• Deletion obligations can extend to relevant third parties

• Collection, use and retention are subject to clearer purpose and proportionality principles

• The California Privacy Protection Agency has dedicated regulatory authority

The result is not a separate law but a broader version of the original CCPA.

No. The CPRA does not replace the CCPA. It amended and expanded the existing law. Businesses follow the CCPA as amended by the CPRA together with the regulations currently in effect. “CPRA compliance” is widely used in business and search contexts, but the official legal framework remains the amended CCPA.

Yes. The California Privacy Protection Agency (CPPA) implements and enforces the CCPA as amended by the CPRA. It can investigate possible violations, conduct administrative proceedings and impose fines.

The California Attorney General also retains enforcement authority and may bring civil actions.

Personal information generally includes information that identifies, relates to, describes or could reasonably be linked with a consumer or household. The definition also covers information that can reasonably be associated with a consumer or household directly or indirectly.

Examples include:

• Names, addresses and email addresses

• Online identifiers and IP addresses

• Account and transaction records

• Browsing and search activity

• Geolocation and biometric information

• Professional, employment and education data

• Inferences used to create a consumer profile

Cookies may qualify when they can reasonably be linked to a consumer or household. Publicly available, deidentified and aggregate consumer information may be excluded when statutory conditions are met.

Violations of the CCPA as amended by the CPRA can lead to regulatory penalties. The inflation-adjusted amounts applicable in 2026 are:

• Up to $2,663 for each violation

• Up to $7,988 for each intentional violation

• Up to $7,988 for each violation involving personal information of consumers known to be under 16

Consumers cannot sue for every privacy violation. A limited private right of action applies when certain personal information defined by statute is exposed in a qualifying data breach because the business failed to maintain reasonable security procedures.

In qualifying cases, statutory damages are not less than $107 and not greater than $799 per consumer per incident, or actual damages, whichever is greater.

The CPRA does not require prior consent for every cookie. The main question is whether a cookie, pixel, SDK or similar technology uses or discloses personal information in a way that qualifies as a sale or sharing.

Third-party advertising technologies and other tracking technologies may trigger sale or sharing obligations depending on how personal information is disclosed and used. Certain analytics arrangements may also require review. Where the law applies, the business must present relevant disclosures, offer an opt-out mechanism and honor valid Global Privacy Control signals.

CPRA compliance means aligning business practices with the CCPA as amended by the CPRA. A typical compliance process includes:

• Determining whether the law applies

• Mapping personal information and website trackers

• Reviewing collection purposes and retention practices

• Updating notices and privacy policies

• Managing consumer rights requests

• Implementing applicable sale, sharing and limit-use controls

• Honoring Global Privacy Control

• Reviewing vendor contracts and security measures

• Monitoring changes in data practices and regulations

Technology can support these processes, but legal interpretation and final compliance responsibility remain with the business.

The CCPA generally applies to a for-profit business that does business in California, determines the purposes and means of processing personal information and meets at least one statutory threshold:

• More than $26,625,000 in annual gross revenue

• Buying, selling or sharing the personal information of 100,000 or more consumers or households in a calendar year

• Earning 50% or more of annual revenue from selling or sharing consumers’ personal information

The gross revenue threshold is not limited to revenue from California consumers. Sale and sharing are assessed according to their specific meanings under the CCPA as amended by the CPRA.

The CCPA as amended by the CPRA gives California consumers the right to:

• Know what personal information is collected, used, sold or shared

• Access specific pieces of personal information

• Request deletion subject to statutory exceptions

• Correct inaccurate personal information

• Opt out of sale or sharing

• Limit certain uses and disclosures of sensitive personal information

• Exercise their rights without discriminatory treatment

The regulations also establish rights and obligations concerning certain uses of automated decision-making technology (ADMT) involving significant decisions. Covered businesses must comply with the applicable ADMT requirements by January 1, 2027.

Sensitive personal information includes:

• Social Security, driver’s license and passport numbers

• Account login information combined with credentials that allow account access

• Financial account, debit card or credit card information combined with credentials that permit access

• Precise geolocation

• Racial or ethnic origin, religious beliefs and union membership

• Private mail, email and text content

• Genetic and identifying biometric data

• Health, sex life and sexual orientation information

Sensitive personal information does not automatically require consent. The right to limit applies only to specified uses and disclosures outside the purposes permitted by the law and regulations.

Covered businesses must issue appropriate notices, respond to consumer requests, honor applicable opt-outs, address sensitive personal information, maintain relevant contracts and use reasonable security measures.

The regulations effective January 1, 2026 introduced additional duties with separate timelines:

• Certain businesses must conduct risk assessments for specified high-risk processing activities. The requirements apply beginning January 1, 2026. Covered processing already underway before that date must be assessed by December 31, 2027, and required information for assessments conducted in 2026 and 2027 must be submitted to the CPPA by April 1, 2028.

• Businesses meeting the cybersecurity audit criteria have phased first-report deadlines between April 1, 2028 and April 1, 2030.

• Businesses using ADMT for significant decisions must comply with the applicable ADMT requirements by January 1, 2027.

These additional duties apply only when the relevant regulatory criteria are met.