What is CCPA / CPRA?

How CCPA / CPRA Works

Businesses first assess whether they meet applicability thresholds based on three criteria: annual revenue exceeding $25 million, processing personal information of 100,000 or more California consumers or households, or deriving 50 percent or more of annual revenue from selling or sharing personal information. Once applicable, they must implement consumer rights fulfillment infrastructure to handle verifiable consumer requests for access, deletion, correction, and opt-out within 45 days.

The framework requires businesses to deploy privacy notices disclosing data collection practices, retention periods, and intended uses at the point of collection. Two opt-out mechanisms must be provided: a "Do Not Sell or Share My Personal Information" link and a "Limit the Use of My Sensitive Personal Information" link. Businesses must honor opt-out preference signals, including the Global Privacy Control (GPC), without requiring account creation or manual submission. Financial services firms and other regulated industries face additional scrutiny when implementing these mechanisms.

CPRA introduced data minimization, purpose limitation, and storage limitation principles borrowed from GDPR. Businesses must collect only what is reasonably necessary, use data only for disclosed purposes, and retain it no longer than reasonably necessary. For organizations whose data processing presents significant privacy risks, CPRA mandates annual cybersecurity audits and regular risk assessments submitted to the California Privacy Protection Agency (CPPA). The CPPA enforces compliance through administrative fines up to $2,500 per violation and $7,500 per intentional violation or violations involving minors' data.

Why CCPA / CPRA Matters

Without compliance support services, businesses operating in California face administrative fines, expanded private rights of action for data breaches involving email addresses combined with passwords or security questions, and enforcement actions by the CPPA. The framework's applicability thresholds capture far more organizations than many expect. A business with $25 million in annual revenue or processing data from 100,000 California residents operates under the same consumer rights obligations as enterprises ten times its size.

The CPRA's GDPR-inspired principles require operational changes beyond legal review. Data minimization and purpose limitation affect how systems collect and process information. Storage limitation requirements force retention policy audits. Businesses whose processing presents significant risks must now conduct annual cybersecurity audits and submit risk assessments to the CPPA, adding technical compliance overhead to what many initially treated as a legal-only initiative. The CPPA's active rulemaking on automated decision-making technology, cybersecurity audit requirements, and the Delete Act's data broker deletion platform continues expanding compliance scope.

CCPA / CPRA vs. GDPR

The key difference is that CCPA / CPRA applies to businesses meeting specific revenue or data-processing thresholds and focuses on the sale and sharing of personal information, while GDPR applies universally to all entities processing EU residents' data and regulates all forms of data processing.

Common Misconceptions

CCPA / CPRA does not replace or supersede the CCPA entirely. The CPRA amends and strengthens the original CCPA, creating a combined framework often called "CCPA 2.0" rather than a separate replacement regulation.

CCPA / CPRA is not limited to California-based businesses. Any for-profit business operating in California that meets the revenue, data volume, or data sale thresholds must comply, regardless of where the business is headquartered.