CCPA & CPRA Explained: California Privacy Laws Guide 2025

California leads the United States in consumer privacy protection, and understanding the California Consumer Privacy Act (CCPA) and its amendment, the California Privacy Rights Act (CPRA), is essential for CIPP/US certification. With the CPRA's September 2025 regulatory updates taking effect in January 2026, privacy professionals must stay current on California's evolving requirements.

This comprehensive guide covers everything you need to know about CCPA/CPRA for the CIPP/US exam, including the latest 2025-2026 updates, recent enforcement actions, and practical compliance guidance.

What is the CCPA/CPRA?

The California Consumer Privacy Act (CCPA) became effective on January 1, 2020, marking a watershed moment in U.S. privacy law. It was the first comprehensive state privacy law in the nation, granting California residents unprecedented rights over their personal information.

On November 3, 2020, California voters approved Proposition 24, the California Privacy Rights Act (CPRA), which significantly amended and expanded the CCPA. The CPRA is not a separate law but rather a comprehensive amendment that took effect on January 1, 2023.

Major CPRA Enhancements Over Original CCPA

• Created the CPPA: Established the first U.S. state agency dedicated solely to privacy enforcement
• Sensitive Personal Information: Introduced a new category of data requiring heightened protection
• Right to Correction: Added the ability for consumers to correct inaccurate information
• Right to Limit: Allowed consumers to limit use of sensitive personal information
• Sharing: Expanded beyond "sale" to include "sharing" for cross-context behavioral advertising
• Extended Coverage: Removed most B2B and employee exemptions
• Risk Assessments: Required comprehensive assessments for high-risk processing
• Cybersecurity Audits: Mandated independent audits for covered businesses

From CCPA to CPRA: Evolution Timeline

Who Must Comply? Business Thresholds

The CCPA/CPRA applies to for-profit businesses that:

1. Do business in California
2. Collect personal information from California consumers
3. Meet at least ONE of the following thresholds:

The Three Threshold Tests (2025)

Additional Coverage Rules

Controlled Entities: Any entity that controls or is controlled by a covered business, shares common branding, and shares consumer personal information is also covered.

Joint Ventures: Partnerships or joint ventures where each business has at least 40% interest and is composed of covered businesses.

Voluntary Certification: Any person can voluntarily certify to the CPPA that they comply with the CCPA.

Consumer Rights Under CCPA/CPRA

California residents have six major privacy rights. A helpful mnemonic for the CIPP/US exam is "LOCKD-N":

L - Right to Limit Use of Sensitive Personal Information

Consumers can direct businesses to limit the use and disclosure of their sensitive personal information to only:

• Providing goods or services requested by the consumer
• Purposes specified in CCPA regulations (security, fraud prevention, etc.)
• Short-term, transient use for non-personalized advertising

Implementation: Businesses must provide a "Limit the Use of My Sensitive Personal Information" link on their homepage.

Response time: 15 business days maximum

O - Right to Opt-Out of Sale or Sharing

Consumers can direct businesses to stop selling or sharing their personal information to third parties.

Key points:

• "Sale" = exchanging personal information for monetary or other valuable consideration
• "Sharing" = disclosing for cross-context behavioral advertising (added by CPRA)
• Must honor Global Privacy Control (GPC) signals
• Must provide "Do Not Sell or Share My Personal Information" link
• Cannot require account creation to opt-out

Response time: 15 business days maximum

Minors: Different rules apply:

• Under 13: Cannot sell/share without opt-in consent from parent/guardian
• 13-15 years: Cannot sell/share without opt-in consent from the minor themselves
• 16+ years: Standard opt-out applies

C - Right to Correction

Consumers can request that businesses correct inaccurate personal information (added by CPRA).

Process:

• Consumer identifies inaccurate information and provides correction
• Business must correct and notify service providers and contractors
• Business can deny if information is accurate

Response time: 45 days (extendable to 90 days with notice)

K - Right to Know

Consumers can request disclosure of what personal information a business has collected about them.

Businesses must disclose:

• Categories of personal information collected
• Categories of sources from which information was collected
• Business or commercial purposes for collecting or selling
• Categories of third parties with whom information is shared
• Specific pieces of personal information collected (if requested)
• If information was sold or shared, categories and recipients

Response time: 45 days (extendable to 90 days with notice)

Frequency limit: Businesses need only respond twice within a 12-month period

Lookback period: Previously 12 months, but CPRA expanded: If business retains data longer than 12 months, consumers can request information back to January 1, 2022

D - Right to Delete

Consumers can request that businesses delete their personal information.

Process:

• Two-step process allowed for online deletion requests (submit, then confirm)
• Business must delete from its records
• Business must direct service providers and contractors to delete
• Business can deny if information falls under an exception

Response time: 45 days (extendable to 90 days with notice)

Nine Exceptions to Deletion:

1. Complete the transaction or provide requested services
2. Detect security incidents, protect against malicious/illegal activity
3. Debug to identify and repair errors
4. Exercise free speech or ensure another's exercise of free speech
5. Comply with California Electronic Communications Privacy Act
6. Engage in public or peer-reviewed scientific research
7. Enable solely internal uses reasonably aligned with consumer expectations
8. Comply with legal obligations
9. Make other internal and lawful uses compatible with the context

N - Right to Non-Discrimination

Businesses cannot discriminate against consumers for exercising their CCPA rights.

Prohibited actions:

• Denying goods or services
• Charging different prices or rates
• Providing different level or quality of services
• Suggesting consumer will receive different price/level of service

Financial incentives allowed if:

• Consumer opts-in
• Reasonably related to value of consumer's data
• Terms clearly explained
• Consumer can opt-out at any time
• Not unjust, unreasonable, coercive, or usurious

Business Obligations Under CCPA/CPRA

1. Provide Required Notices

Businesses must provide several types of notices:

Notice at Collection:

• Provided at or before the point of collection
• Lists categories of personal information being collected
• Lists purposes for collection
• If selling or sharing, must state that fact
• Link to full privacy policy

Privacy Policy:

• Must be updated at least annually
• Categories of personal information collected (last 12 months)
• Categories of sources
• Business/commercial purposes for collection
• Categories of third parties with whom information is shared
• Categories sold or shared (last 12 months) and to whom
• Data retention periods or criteria for determining them
• Consumer rights and how to exercise them
• If using sensitive personal information, disclosure of uses

Notice of Right to Opt-Out:

• "Do Not Sell or Share My Personal Information" link on homepage
• Must use this language or substantially similar
• Must be clear and conspicuous
• Cannot require account creation

Notice of Right to Limit:

• "Limit the Use of My Sensitive Personal Information" link if applicable
• Must be provided in same manner as collection of SPI

2. Honor Consumer Requests

Methods for Submitting Requests:

• Must provide at least TWO methods
• Must include toll-free number and website (if business has one)
• Online-only businesses can provide just email and toll-free number
• Cannot require account creation for opt-out requests

Verification Requirements:

• Must verify identity using reasonable methods
• Level of verification should match sensitivity of information
• Account holders: Can verify through existing authentication
• Non-account holders: Match 2-3 data points previously collected

Response Timeframes:

3. Maintain Proper Contracts

Service Provider Contracts Must Include:

• Disclosure is for limited and specific purposes
• Service provider must comply with CCPA
• Service provider must provide same level of privacy protection
• Business has right to ensure compliance
• Service provider must notify business if unable to meet obligations
• Business has right to take steps to stop unauthorized use

4. Respect Opt-Out Preference Signals

Businesses must honor browser-based opt-out preference signals like Global Privacy Control (GPC).

• Must recognize GPC as valid opt-out request
• Must configure website to honor signals by default
• Must indicate when signal is processed (e.g., "Opt-Out Request Honored")
• Cannot require additional steps beyond the signal

5. Implement Security Measures

Businesses must implement reasonable security procedures and practices to protect personal information.

While specific measures aren't prescribed, enforcement actions show expectations:

• Encryption for sensitive data
• Access controls and authentication
• Regular security testing and assessments
• Incident response procedures
• Employee training on data protection

6. Keep Records

All Covered Businesses: Must keep records of consumer requests for at least 24 months, including:

• Date of request
• Method of request
• Date and nature of response
• Basis for any denial

High-Volume Businesses (4M+ consumers/year): Must additionally compile and disclose metrics:

• Number of requests received by type
• Number complied with and denied
• Median response time
• Must disclose these metrics in privacy policy

Sensitive Personal Information

The CPRA introduced "Sensitive Personal Information" (SPI) as a subset of personal information requiring heightened protection. Consumers have the right to limit the use and disclosure of SPI.

Categories of Sensitive Personal Information

2025-2026 Major Updates

On July 24, 2025, the CPPA approved sweeping regulatory updates that were finalized by the Office of Administrative Law on September 23, 2025. These regulations represent the most significant expansion of CCPA/CPRA requirements since the law's inception.

1. Automated Decision-Making Technology (ADMT) Requirements

Effective Date: January 1, 2027

What is ADMT? Technology that replaces or substantially replaces human decision-making in significant decisions affecting consumers.

Significant Decisions Include:

• Employment eligibility, hiring, promotion, termination
• Credit or lending approval
• Healthcare diagnosis or treatment
• Housing eligibility
• Education admission or performance evaluations
• Insurance underwriting or pricing

Key Changes from Proposed Rules:

• Removed "AI" terminology to avoid ambiguity
• Removed behavioral advertising from "significant decisions"
• Narrowed to technologies that "replace or substantially replace" human decision-making

Business Obligations for ADMT:

1. Pre-Use Notice: Inform consumers before using ADMT for significant decisions
2. Opt-Out Right: Allow consumers to opt-out of ADMT decisions
3. Access Rights: Upon request, explain in plain language:
   • Specific purpose of the ADMT
   • Logic and key parameters that affected the output
   • How the output influenced the decision
   • Role of any human involvement
   • Data sources and assumptions used
4. Opt-In for Sensitive Info: Must obtain opt-in consent when ADMT processes sensitive personal information or information about minors
5. Human Review Exception: ADMT systems with meaningful human oversight or override are partially exempted
6. 12-Month Wait: After consumer opts out, must wait 12 months before requesting consent to resume ADMT

2. Cybersecurity Audit Requirements

Who Must Audit: Businesses meeting specific risk-based thresholds (generally large businesses processing significant volumes of personal information)

Phased Implementation by Revenue:

After First Audit: Must complete annual audits every 12 months

Auditor Requirements:

• Independent third party (internal or external)
• Qualified to assess cybersecurity controls
• Must have appropriate expertise and credentials

Audit Must Assess:

• Security controls protecting personal information
• Compliance with CCPA security obligations
• Effectiveness of security program
• Incident response capabilities

3. Risk Assessment Requirements

Effective Date: January 1, 2026

Activities Requiring Risk Assessment:

• Processing any sensitive personal information (with limited employment exemption)
• Using ADMT for significant decisions
• Using personal information to train ADMT systems
• Using automated processing to infer sensitive information about consumers
• Profiling based on sensitive location activities (hospitals, places of worship, political offices, schools)
• Processing involving facial recognition, emotion recognition, or identity verification

Risk Assessment Must Include:

• Detailed description of processing purpose(s)
• Categories of personal information involved
• Assessment of benefits to business and consumers
• Assessment of potential risks to consumer privacy
• Safeguards in place to mitigate risks
• Consideration of less intrusive alternatives

Annual Attestation: Covered businesses must attest annually to completing required risk assessments

4. Insurance Clarifications

Regulations clarify when insurance companies must comply with CCPA:

• Exemptions for information subject to Gramm-Leach-Bliley Act (GLBA)
• But CCPA applies to information not covered by GLBA (e.g., website tracking, marketing)
• Specific guidance on employee benefits information

5. Enhanced Transparency Requirements

Prohibition on Vague Disclosures: No more general statements like "to improve services"—must specify exact categories of data and specific purposes

Cookie Consent Requirements:

• Cannot obtain consent without affirmative selection
• Must have "I accept" button or equivalent
• Pre-checked boxes not permitted

Opt-Out Signal Confirmation: Must provide visible confirmation when opt-out preference signals are honored (e.g., "Opt-Out Request Honored" message)

6. Extended Right to Know Lookback

If a business retains personal information for longer than 12 months, it must provide consumers a method to request information collected prior to the 12-month period, going back to January 1, 2022.

7. Data Broker Registration and DELETE Act

Effective Date: Various (DELETE Act fully effective August 1, 2026)

Data brokers must:

• Register annually with CPPA by January 31
• Pay annual registration fee
• Access centralized deletion mechanism every 45 days
• Process deletion requests within 45 days
• Undergo independent audit every three years (starting January 2028)
• Provide enhanced disclosures about privacy practices

Penalties for Non-Registration: $200 per day up to maximum fine

Enforcement and Penalties

Enforcement Authorities

California Privacy Protection Agency (CPPA):

• Established by CPRA as first U.S. state agency dedicated solely to privacy
• Primary enforcement authority since July 1, 2023
• Can investigate violations, issue subpoenas, conduct audits
• Can bring administrative enforcement actions
• 5-member Board appointed by Governor and Legislature

California Attorney General:

• Retains concurrent enforcement authority
• Has brought several major settlements (Sephora, DoorDash, Healthline)
• Can bring civil enforcement actions in court

Administrative Fines and Civil Penalties (Updated January 2025)

Effective January 1, 2025, penalties adjusted for inflation:

Critical Points:

• NO CAP on total penalties (unlike GDPR's 4% of global revenue cap)
• Penalties are PER VIOLATION—can multiply quickly
• Each affected consumer can constitute a separate violation
• Penalties adjust every two years based on California CPI

Private Right of Action

Consumers can bring civil lawsuits for data breaches involving:

• Non-encrypted and non-redacted personal information
• Unauthorized access and exfiltration, theft, or disclosure
• Resulting from business's failure to implement reasonable security

Damages:

• Between $100 and $750 per consumer per incident, OR
• Actual damages, whichever is greater

Class Action Risk: Can result in massive liability when thousands of consumers are affected

No Private Right for Other Violations: Consumers cannot sue for violations of rights (e.g., failure to honor deletion request)—only regulatory agencies can enforce

Cure Period

CCPA: 30-day cure period mandatory before penalties

CPRA: CPPA has discretion whether to provide cure period—no longer mandatory. In practice:

• CPPA has sometimes provided opportunities to remedy violations
• But no guarantee of cure period
• Intentional or egregious violations unlikely to receive cure opportunity

2024-2025 Enforcement Actions: Key Cases

Tractor Supply Company - $1.35 Million (September 2025)

Violations:

• Ineffective opt-out mechanisms—webform didn't actually stop tracking
• Failed to honor GPC signals until July 2024
• Failed to update privacy policy annually (updated Nov 2021, not again until after investigation)
• Inadequate job applicant privacy notices
• Insufficient service provider contracts with ad tech companies

Significance: Largest CPPA fine to date; first case addressing job applicant rights; established CPPA can investigate conduct back to January 1, 2020

Healthline Media - $1.55 Million (July 2025)

Violations:

• Sold/shared data showing consumers reading medical condition articles
• Inadequate service provider contracts—assumed compliance without verification
• Failed to provide clear notices about data sharing with ad networks

Significance: Settlement prohibits selling/sharing data showing someone is reading medical articles—stricter than CCPA baseline requirements

Honda - $632,500 (March 2025)

Violations:

• Inadequate privacy policy disclosures
• Failed to properly respond to consumer requests
• Insufficient notice about data collection and sharing

Todd Snyder - $345,178 (May 2025)

Violations:

• Opt-out and privacy request processes failed to meet CCPA standards
• Ineffective mechanisms for exercising consumer rights

Sephora - $1.2 Million (2022)

Violations:

• Failed to disclose selling personal information
• Did not honor GPC signals
• Did not cure within required period

Significance: First major CCPA enforcement action, set tone for future enforcement

DoorDash - $375,000 (2024)

Violations:

• Participated in marketing cooperative that shared customer data
• Inadequate notice to consumers
• Failed to provide opportunity to opt-out

Common Violation Patterns

Based on enforcement actions, businesses most commonly fail in these areas:

1. Ineffective Opt-Out Mechanisms: Having a link/form that doesn't actually stop data sale/sharing
2. GPC Non-Compliance: Not honoring browser-based opt-out signals
3. Inadequate Contracts: Service provider agreements lacking required CCPA terms
4. Insufficient Notices: Vague, incomplete, or outdated privacy policies
5. Notice at Collection Failures: Not informing consumers at point of collection
6. Annual Update Failure: Not updating privacy policy at least annually
7. Dark Patterns: Using manipulative UI to discourage privacy choices
8. Data Broker Non-Registration: Failing to register and pay annual fee

Steps to Compliance

1. Determine if CCPA/CPRA Applies

• Calculate annual revenue (global, not just California)
• Count California consumers/households whose data you buy/sell/share
• Calculate revenue derived from selling/sharing personal information
• Remember: Measured on rolling 12-month basis
• Consider controlled entity and joint venture rules

2. Conduct Data Inventory and Mapping

• Identify all personal information collected
• Document sources of collection
• Map data flows to third parties
• Identify sensitive personal information
• Determine what constitutes "sale" and "sharing"
• Document retention periods for each category

3. Update Privacy Notices

Privacy Policy must include:

• All required disclosures (see obligations section above)
• Consumer rights and how to exercise them
• Contact methods (toll-free number, website)
• If high-volume business: metrics on requests
• Specific purposes for each category of data
• Data retention periods or criteria

Notice at Collection must include:

• Categories being collected
• Purposes for collection
• Whether data will be sold or shared
• Link to privacy policy

Update frequency: At least annually, and whenever there's a material change

4. Implement Consumer Rights Mechanisms

• Create at least two methods for submitting requests
• Add "Do Not Sell or Share" link to homepage
• Add "Limit the Use of My Sensitive Personal Information" link if applicable
• Implement GPC signal recognition
• Develop verification procedures
• Create internal processes to respond within deadlines
• Train staff on handling requests

5. Review and Update Third-Party Contracts

• Ensure service provider agreements include all required terms
• Review contracts with advertising technology providers
• Verify third parties can support CCPA compliance
• Include audit rights
• Don't assume compliance—verify it

6. Implement Technical Controls

• Configure systems to honor opt-out requests
• Implement GPC signal processing
• Ensure opt-out mechanisms actually stop data sale/sharing
• Create ability to delete data upon request
• Implement data retention limits
• Use encryption for sensitive data
• Implement access controls

7. Prepare for 2026-2027 Requirements

Risk Assessments (By January 1, 2026):

• Identify processing activities requiring assessment
• Develop assessment templates and procedures
• Complete assessments for all applicable activities
• Prepare for annual attestation

ADMT Compliance (By January 1, 2027):

• Inventory all automated decision-making systems
• Determine which involve "significant decisions"
• Create pre-use notices
• Implement opt-out mechanisms
• Develop processes to explain ADMT logic and parameters
• Get opt-in consent for SPI processing by ADMT

Cybersecurity Audits (By April 2028-2030):

• Determine if your revenue triggers audit requirement
• Identify deadline based on revenue tier
• Select independent auditor (internal or external)
• Conduct security assessment and remediation now
• Prepare documentation and evidence
• Plan for annual audits going forward

8. Maintain Ongoing Compliance

• Monitor for threshold changes (revenue, consumer count)
• Track regulatory updates—CPPA regularly issues new guidance
• Keep records of all consumer requests for 24 months
• Update privacy policy at least annually
• Provide required training to staff
• Conduct periodic compliance audits
• Stay informed on enforcement actions to learn from others' mistakes

CIPP/US Exam Focus Areas

For the CIPP/US exam, California state privacy law typically represents 50% or more of the state privacy law questions (with the September 2026 exam update, state law questions increase from 6-8 to 13-17 questions total). Here's what to prioritize:

High-Priority Topics

Commonly Tested Concepts

• Global Privacy Control (GPC): Must honor, must indicate when honored
• Minor protections: Under 13 = parent opt-in required; 13-15 = minor's own opt-in
• Deletion exceptions: Know at least 5 of the 9
• Financial incentives: Allowed if opt-in, reasonably related to value, revocable
• Notice at collection vs. privacy policy: Different requirements and timing
• High-volume business obligations: 4M+ consumers = metrics disclosure
• Enforcement: Dual enforcement by CPPA and Attorney General
• Penalties: $2,628 unintentional, $7,884 intentional/minors, no cap

2025-2026 Update Areas

Newer material more likely to appear on exam:

• ADMT requirements (effective 2027)
• Risk assessment triggers and requirements
• Cybersecurity audit phasing
• Neural data as SPI (September 2025)
• Citizenship/immigration status as SPI (2024)
• DELETE Act and data broker obligations
• Recent enforcement actions and common violations

Comparison with Other State Laws

Exam may test your ability to compare California with other states:

Study Tips for California Law

Common Exam Traps

Key Takeaways

California's CCPA/CPRA represents the most comprehensive state privacy law in the U.S. and serves as a model for other states. For the CIPP/US exam:

1. California dominates state law questions—expect it to represent ~50% of state privacy law content
2. The CPRA is an amendment to CCPA, not a separate law—together they're referred to as "CCPA, as amended"
3. Three business thresholds: $26.625M revenue, 100K consumers, or 50% revenue from sales/sharing
4. Six consumer rights (LOCKD-N): Limit SPI, Opt-out, Correct, Know, Delete, Non-discrimination
5. Sensitive personal information is a special category requiring heightened protection (11+ categories)
6. Major 2025-2026 updates: ADMT requirements (2027), cybersecurity audits (2028+), risk assessments (2026)
7. Enforcement is aggressive: CPPA and AG have brought numerous actions with millions in fines
8. Common violations: Ineffective opt-out mechanisms, GPC non-compliance, inadequate contracts
9. Penalties adjusted for inflation: $2,628 per violation (unintentional), $7,884 (intentional/minors)
10. No cure period guarantee under CPRA—CPPA has discretion