CCPA and CPRA
Also known as: CCPA, CPRA, California Consumer Privacy Act, California Privacy Rights Act, Prop 24
The California Consumer Privacy Act (CCPA), as expanded by the California Privacy Rights Act (CPRA), is the most influential US state privacy law.
It gives Californians the right to know what data businesses collect, to delete and correct it, and to opt out of its sale or sharing for targeted advertising. While it's narrower than Europe's GDPR, its reach is broad because California's economy is so large.
CCPA and CPRA, explained at three levels
At home
If you live in California, the CCPA lets you ask companies what personal information they have about you, ask them to delete it, and tell them not to sell or share it. Many websites show a 'Do Not Sell or Share My Personal Information' link because of this law.
At work
Businesses that meet certain size or data thresholds and handle Californians' data must follow the CCPA. That includes companies based outside California, including Canadian businesses with enough California customers.
At home
The CPRA added the right to correct inaccurate information and to limit how businesses use 'sensitive' data like precise location, health details, or government ID numbers. It also requires businesses to honour browser signals like Global Privacy Control as an opt-out request.
At work
The law applies to for-profit businesses that exceed an annual revenue threshold (adjusted for inflation, a little over US$26 million), handle data of 100,000 or more consumers or households, or earn at least half their revenue from selling or sharing personal information. Obligations include privacy notices, rights request handling, opt-out mechanisms, and contracts with service providers.
At home
'Sharing' under the CPRA specifically means cross-context behavioural advertising, closing a loophole where companies argued that passing data to ad networks wasn't technically a 'sale.' In my opinion, that definitional fix mattered more than any new right, because it targeted how the ad-tech ecosystem actually works.
At work
The newer regulations add risk assessments for high-risk processing, cybersecurity audits for certain businesses, and notice and opt-out rights for some uses of automated decision-making technology, with deadlines phased over several years. Unlike GDPR, the CCPA has no general requirement for a lawful basis to process data, but it imposes purpose limitation and data minimization. Enforcement comes from both the agency and the attorney general, and a limited private right of action covers certain data breaches.
Real-world examples
At home
Fatima lives in San Diego and turned on Global Privacy Control in her browser. When she visits retail websites, they receive her opt-out signal automatically and must stop selling or sharing her data for targeted ads, without her clicking each site's opt-out link.
At work
Thomas is a privacy analyst at a Canadian e-commerce company with many California customers. After confirming the company met CCPA thresholds, his team added a 'Do Not Sell or Share' link, set up the website to honour Global Privacy Control, and reviewed contracts with ad partners.
How it compares
| feature | CCPA and CPRA | GDPR |
|---|---|---|
| Scope | Businesses meeting thresholds that handle Californians' data | Almost any organization processing EU residents' data |
| Lawful basis required | No general requirement | Yes, one of six legal bases |
| Model | Mostly opt-out for sale and sharing | Often opt-in consent, depending on basis |
| Regulator | California Privacy Protection Agency and attorney general | National data protection authorities |
| Maximum fines | Per-violation penalties, higher if intentional | Up to 4% of global turnover |
The CCPA is narrower than GDPR but has become the template for US state privacy laws.
For analysts
If you serve US consumers, I'd treat California's rules as the baseline, then check other states for differences. Honouring Global Privacy Control site-wide is a cheap, visible way to show regulators you take opt-outs seriously.
History & origin
The CCPA was passed quickly in June 2018, largely to head off a stricter ballot initiative, and took effect on January 1, 2020. Voters then approved the CPRA through Proposition 24 in November 2020, which expanded the law and created a dedicated regulator, the California Privacy Protection Agency, with most changes operative from January 1, 2023. The California attorney general's first major enforcement settlement, against Sephora in 2022, involved failure to honour opt-out signals. In 2025, the state finalized regulations on automated decision-making technology, risk assessments, and cybersecurity audits, with obligations phasing in from 2026. The Delete Act also created a single platform for deleting data held by registered data brokers. In my view, California has done more to shape American privacy practice than Congress has.