CCPA and CPRA
Also known as: CCPA, CPRA, California Consumer Privacy Act, California Privacy Rights Act, Prop 24
The California Consumer Privacy Act (CCPA), as expanded by the California Privacy Rights Act (CPRA), is the most influential US state privacy law.
It gives Californians the right to know what data businesses collect, to delete and correct it, and to opt out of its sale or sharing for targeted advertising. While it's narrower than Europe's GDPR, its reach is broad because California's economy is so large.
CCPA and CPRA, explained at three levels
At home
Think of the CCPA as a receipt you can demand from any large business that collects your data. If you live in California, you can ask what it gathered, where it came from, and who it shared it with, then ask it to correct or delete the data. You can also tell it to stop selling or sharing your information, which is why many sites show a 'Do Not Sell or Share' link.
At work
The CCPA, as amended by the CPRA, is California's comprehensive consumer privacy law. It gives California residents, including employees and business contacts, rights over their personal information, and it puts duties on for-profit businesses that cross certain thresholds, wherever they are based. Businesses care because it set the template for other US states, it has a dedicated regulator, and Canadian companies with enough California customers fall within its reach.
At home
The law works through a set of rights plus a special category of data. You can know, delete, correct, and opt out of the sale or sharing of your information. 'Sensitive personal information,' such as precise location, health details, government ID numbers, or account logins, gets an extra right to limit its use to what the service needs. Businesses must also treat browser signals such as Global Privacy Control as a valid opt-out, so one setting can cover every site.
At work
The CCPA applies to for-profit businesses that do business in California and meet one threshold: annual gross revenue above an inflation-adjusted figure of a little over US$26 million, buying, selling, or sharing data of 100,000 or more consumers or households, or earning at least half their revenue from selling or sharing personal information. Core duties are a notice at collection, answering rights requests within 45 days, opt-out links, and contracts that restrict how service providers use the data.
At home
The CPRA's key mechanical change was defining 'sharing' as passing data for cross-context behavioural advertising, meaning ads targeted using your activity across other companies' sites and apps. Before that, ad-tech firms argued that no money changed hands, so nothing was 'sold.' The new definition captures the ad networks and tracking pixels that power most targeted ads. In my opinion, that definitional fix mattered more than any new right, because it targeted how the ad-tech ecosystem actually works.
At work
The 2025 regulations add three layers: risk assessments for high-risk processing such as selling data or using sensitive information, cybersecurity audits for larger or data-heavy businesses, and notice, opt-out, and access rights for automated decision-making technology used in significant decisions, with deadlines phasing in from 2026 to about 2030. Unlike GDPR, the law needs no lawful basis, but it imposes purpose limitation and data minimization. The agency and the attorney general share enforcement, plus a narrow private right of action for breaches.
Real-world examples
At home
Fatima lives in San Diego and turned on Global Privacy Control in her browser. When she visits retail websites, they receive her opt-out signal automatically and must stop selling or sharing her data for targeted ads, without her clicking each site's opt-out link.
At work
Thomas is a privacy analyst at a Canadian e-commerce company with many California customers. After confirming the company met CCPA thresholds, his team added a 'Do Not Sell or Share' link, set up the website to honour Global Privacy Control, and reviewed contracts with ad partners.
How it compares
| feature | CCPA and CPRA | GDPR |
|---|---|---|
| Scope | Businesses meeting thresholds that handle Californians' data | Almost any organization processing EU residents' data |
| Lawful basis required | No general requirement | Yes, one of six legal bases |
| Model | Mostly opt-out for sale and sharing | Often opt-in consent, depending on basis |
| Regulator | California Privacy Protection Agency and attorney general | National data protection authorities |
| Maximum fines | Per-violation penalties, higher if intentional | Up to 4% of global turnover |
The CCPA is narrower than GDPR but has become the template for US state privacy laws.
For analysts
If you serve US consumers, I'd treat California's rules as the baseline, then check other states for differences. Honouring Global Privacy Control site-wide is a cheap, visible way to show regulators you take opt-outs seriously.
History & origin
The CCPA was passed quickly in June 2018, largely to head off a stricter ballot initiative, and took effect on January 1, 2020. Voters then approved the CPRA through Proposition 24 in November 2020, which expanded the law and created a dedicated regulator, the California Privacy Protection Agency, with most changes operative from January 1, 2023. The California attorney general's first major enforcement settlement, against Sephora in 2022, involved failure to honour opt-out signals. In 2025, the state finalized regulations on automated decision-making technology, risk assessments, and cybersecurity audits, with obligations phasing in from 2026. The Delete Act also created a single platform for deleting data held by registered data brokers. In my view, California has done more to shape American privacy practice than Congress has.