California Privacy Rights Act (CPRA) - Compliance Guide

· About California Privacy Rights Act (CPRA)

Key Takeaways

  • The CPRA amended the California Consumer Privacy Act and, as of 1 January 2023, its statutory amendments are in force for covered businesses handling California residents’ personal information.[4]
  • The California Privacy Protection Agency (CPPA) is the primary administrative enforcer of the CCPA/CPRA framework, while the California Attorney General also retains enforcement authority.[3][4]
  • New California privacy regulations effective 1 January 2026 add operational obligations including risk assessments, opt-out confirmation, and expanded rules for sensitive personal information and automated decision-making.[7][10][12]
  • Businesses that meet the CPRA/CCPA thresholds must honor consumer rights requests, provide required notices, and implement reasonable security controls; violations can trigger civil penalties and enforcement actions.[4][15]
  • Mandatory cybersecurity audits are being phased in by revenue band, with the first compliance dates starting in 2027 for the largest covered businesses.[5][14]
  • The framework applies to some businesses outside California if they do business in California and meet the statute’s thresholds, so extraterritorial reach is a core compliance issue.[4][15]

What It Is

The California Privacy Rights Act is the 2020 ballot initiative that amended the California Consumer Privacy Act, expanding consumer rights, creating the CPPA, and strengthening business obligations around personal information.[3][6] The operative statutory amendments were in effect by 1 January 2023, and California’s privacy regulations were further updated with a new package effective 1 January 2026.[4][7][12]

The law is enforced by the California Privacy Protection Agency and the California Attorney General, with administrative and civil enforcement available for violations of the CCPA/CPRA framework.[3][4] The CPRA ballot measure established the CPPA as a state agency “vested with full administrative power, authority, and jurisdiction” to implement and enforce the statute.[3]

Key dates:

  • 3 November 2020 — CPRA approved by California voters as Proposition 24.[6]
  • 1 January 2023 — CPRA amendments to the CCPA became operative in statute.[4]
  • 1 January 2026 — revised CCPA/CPRA regulations took effect, adding new compliance mechanics for risk assessments, opt-outs, and related topics.[7][10][12]
  • 2027 onward — cybersecurity audit obligations begin phasing in by revenue tier.[5][14]

Who Must Comply

The CPRA applies to businesses subject to the CCPA, including entities that do business in California and collect California residents’ personal information, if they meet the statute’s size or data-use thresholds.[4][15] The commonly applied thresholds are annual gross revenues over $25 million, or buying, selling, or sharing the personal information of 100,000 or more California consumers or households, or deriving 50% or more of annual revenue from selling or sharing personal information.[15]

The law has extraterritorial reach because a company does not need to be headquartered in California to be covered; doing business in California and meeting the thresholds is enough.[4][15] Separate obligations may also apply to service providers, contractors, and third parties through contract and downstream-use rules.[4]

Exemptions remain for some entities and data, including certain information already governed by other sector-specific laws, and the regulations continue to carve out particular records and contexts.[4][5] California’s 2026 materials also note that entities covered by the California Insurance Code are newly within scope for CCPA applicability, although information already governed by the Insurance Code remains exempt.[5]

Core Requirements

  1. Consumer rights handling — Covered businesses must provide mechanisms for consumers to exercise rights to know, delete, correct, and opt out of sale or sharing, and they must respond within the statutory timelines.[4][15]
  2. Sensitive personal information controls — Businesses must give consumers notice and the right to limit certain uses of sensitive personal information, with 2026 updates expanding the practical treatment of some youth data and related rights workflows.[5][10][12]
  3. Risk assessments — From 1 January 2026, businesses must conduct risk assessments before certain high-risk processing activities and retain the documentation required by the CPPA’s rules.[10][12]
  4. Opt-out confirmation — Businesses must provide a way for consumers to confirm that an opt-out request, including one submitted via a signal such as the Global Privacy Control, has been processed.[10][12]
  5. Automated decision-making governance — New regulations address the use of automated decision-making technology (ADMT) for significant decisions, requiring enhanced notices and compliance controls where the rules apply.[5][13]
  6. Security safeguards — Businesses must maintain reasonable security procedures and practices appropriate to the nature of the information, because security failures can support enforcement and private litigation under the CCPA framework.[4][15]
  7. Contracting and downstream restrictions — Businesses must use contracts to limit how service providers, contractors, and third parties use personal information, and they must manage disclosures accordingly.[4][15]

Deadlines and Penalties

| milestone | date | what applies | |---|---:|---| | CPRA amendments operative | 1 January 2023 | Statutory CPRA amendments to the CCPA are in force.[4] | | New CPPA regulations effective | 1 January 2026 | Risk assessments, opt-out confirmation, and related revised rules apply.[7][10][12] | | Cybersecurity audit phase 1 | 1 April 2028 | Large businesses in the highest revenue band must complete the first annual audit cycle for 2026–2027 coverage.[5][11] | | Cybersecurity audit phase 2 | 1 April 2029 | Mid-tier businesses in the next revenue band enter the audit cycle.[5] | | Cybersecurity audit phase 3 | 1 April 2030 | Businesses below the higher revenue bands but still covered enter the audit cycle.[5] |

Maximum civil penalties under the California privacy framework are generally $2,500 per violation and $7,500 per intentional violation or violation involving a minor, with separate exposure depending on the enforcement theory and whether the matter is cured or uncured.[15] The CPPA and Attorney General can also seek injunctive relief, audit-related remedies, and other administrative sanctions, and consumers may pursue limited private litigation for certain security-related breaches.[4][15]

How to Comply

  1. Map applicability and scope — Confirm whether the organization meets the CCPA/CPRA thresholds and identify which business units, vendors, and data flows touch California residents.[4][15]
  2. Classify data and uses — Build a data inventory that distinguishes personal information, sensitive personal information, youth data, and any data subject to sectoral exemptions.[4][5][10]
  3. Upgrade rights workflows — Align intake, identity verification, response, appeals, and logging for know, delete, correct, limit, and opt-out requests, including confirmation that opt-outs were processed.[4][10][12]
  4. Run risk assessments for high-risk processing — Use a formal assessment process that maps well to NIST CSF 2.0 governance and risk functions, and maintain documentation suitable for CPPA review.[10][12]
  5. Implement a privacy management system — Use ISO 27001 for security controls, ISO 42001 for AI governance where ADMT is in scope, and documented control ownership, testing, and internal audit cycles.[5][13]
  6. Update contracts and notices — Revise privacy notices, vendor agreements, and downstream use restrictions so service providers and contractors are contractually limited to permitted purposes.[4][15]
  7. Prepare for audit obligations — If revenue thresholds place the company in a phased cybersecurity audit cohort, define scope, evidence collection, and certification timelines now rather than in the compliance year.[5][14]
  8. Test complaints and incident readiness — Maintain procedures for regulator inquiries, consumer complaints, and security incidents, because enforcement and private claims may follow control failures.[4][15]

Related Regulations

  • CCPA — The CPRA amends and builds on the CCPA, so the two are effectively one integrated California consumer privacy regime in practice.[4][15]
  • Virginia Consumer Data Protection Act — Virginia’s law is narrower in several respects and does not mirror California’s opt-out, correction, and agency-enforcement structure as closely as CPRA does.
  • Colorado Privacy Act — Colorado overlaps on consumer rights and universal opt-out concepts, but California’s 2026 risk-assessment and audit structure is more prescriptive.
  • EU GDPR — GDPR is broader on lawful bases and cross-border processing, while CPRA is more centered on notice, rights handling, and sale/sharing controls.
  • California Insurance Code privacy rules — CPRA now reaches some insurance-sector entities, but insurance-specific information can still remain exempt where another California privacy regime already governs it.[5]

FAQ

Does CPRA apply to companies outside California?

Yes, if the company does business in California and meets the statutory thresholds for revenue or data processing volume.[4][15] Headquarters location is not the controlling factor. Extraterritorial scope is one of the main reasons non-California companies need a California-specific privacy program.

Does CPRA require a privacy policy?

Yes. Covered businesses must provide notices that explain categories of personal information collected, disclosed, sold, or shared, plus consumer rights and how to submit requests.[4][15] The notice must be kept aligned with actual data practices, not just drafted as a template.

Does CPRA ban selling personal information?

No, but it gives consumers the right to opt out of sale and sharing of personal information, and businesses must honor that choice.[4][15] California’s 2026 regulations also require a method for consumers to confirm that the opt-out was processed.[10][12]

Are cybersecurity audits mandatory under CPRA?

Yes, for covered businesses that meet the revenue-based phase-in thresholds, starting in 2027 and continuing in later phases.[5][14] The audit obligation is not universal, but it will apply to a significant subset of larger businesses.

Do the 2026 rules change consumer rights?

Yes. The 2026 regulations add implementation detail for risk assessments, opt-out confirmation, and operational handling of certain automated decision-making and sensitive-data obligations.[10][12][13] They do not replace the core CPRA rights architecture; they operationalize it.

Is there still uncertainty about enforcement timing?

The broad enforcement structure is settled, but some specific obligations are still subject to the CPPA’s evolving regulations and implementation guidance.[7][10][12] Where a requirement is phased in or tied to future compliance dates, companies should treat it as active planning work even before the later deadline.

Sources

Put it into practice

More compliance guides