California Privacy Rights Act (CPRA)

The California Privacy Rights Act (CPRA) amends the CCPA and enhances privacy protections for California residents, including additional rights over personal data and the creation of a new enforcement agency.

JurisdictionCalifornia
CategoryPrivacy & Data Protection
StatusActive
Effective date
Latest development

Analysis

California Privacy Rights Act (CPRA) Key Requirements

1. Consumer Rights

  • Right to Opt-Out: Consumers can now opt out of businesses sharing and selling their personal information (PI) specifically for behavioral advertising, not just the sale of PI [1].
  • Right to Limit Use: Consumers have the right to limit the use and disclosure of their sensitive personal information (SPI) [1].
  • Right to Correct: Consumers have the right to correct inaccurate personal information [3].
  • Right to Delete: Businesses must delete PI upon request and notify third parties to delete the same [1].
  • Right to Know: Consumers can request access to PI collected beyond the original 12-month limit in the CCPA [1].
  • Right to Data Portability: Consumers can request to have their PI transported to other businesses or organizations [1].
  • Right to Opt-Out of Automated Decision-Making: Consumers can opt out of the use of PI for automated decision-making [3].

2. Data Protection Measures

  • Data Minimization: Businesses must collect and process only the data necessary for the specified purpose and cannot retain it longer than needed [3].
  • Purpose Limitation: Clear documentation of data collection purposes and retention policies is required [3].
  • Security Procedures: Businesses must implement reasonable security procedures for personal information [2].

3. Enforcement and Compliance

  • New Enforcement Agency: The California Privacy Protection Agency (CPPA) is established as the primary body responsible for enforcing the CPRA, alongside the Attorney General [3].
  • Audits and Penalties: The CPPA has dedicated resources and authority to monitor compliance, investigate violations, and impose penalties [3].

Common Compliance Challenges

1. Data Awareness

  • Identifying Scattered Data: Businesses struggle with data awareness, as data is often spread across various systems and services. A strong data discovery framework is vital to identify and catalog all data, tag it with metadata, and create a single source of truth [2].
  • Ensuring Third-Party Compliance: Businesses must ensure third parties handle personal information securely. Thorough due diligence is required to avoid compliance issues, and failing to enforce contracts or audit rights can lead to legal risks [2].

2. Inadequate Data Protection Measures

  • Implementing Security Procedures: Businesses need to gain comprehensive visibility into data access across various systems and implement effective governance controls. Techniques such as field-level encryption, data pseudonymization, and data masking can enhance data security [2].

3. Employee Training

  • Privacy Training Programs: Achieving CPRA compliance requires collaboration across all departments. Businesses must focus on providing proper privacy training programs to ensure all personnel handling consumer inquiries understand consumer data rights [2].

Best Practices for Implementation

1. Assessing Coverage

  • Revenue Thresholds: Companies operating in California with annual revenues exceeding $25 million or processing data of 100,000 or more consumers fall under the CPRA’s jurisdiction [3].

2. Updating Privacy Policies

  • Clear Explanations: Privacy policies must be updated to align with CPRA requirements. These updates should clearly explain consumer rights, opt-out options, and data retention policies [3].

3. Data Mapping and Inventory

  • Understanding Data Flow: Businesses must understand what personal data they collect, how it flows through their systems, and where it is stored. Without this visibility, fulfilling consumer requests for data access, correction, or deletion becomes nearly impossible [3].

4. Training Teams

  • Regular Training: Businesses must train their teams on CPRA compliance. Regular training ensures all stakeholders are aligned with compliance goals, whether managed by a Chief Privacy Officer, legal counsel, or dedicated compliance team [3].

5. Contract Review

  • Updated Contracts: Contracts with third-party service providers must be reviewed and updated to meet CPRA standards. These contracts should specify obligations around data processing, retention, and sharing [3].

Recent Updates or Changes

The CPRA has introduced several new consumer rights and enhanced existing ones, including the right to correct inaccurate personal information, limit the use of SPI, and opt out of automated decision-making technology [3].

Related Regulations or Standards

  • General Data Protection Regulation (GDPR): Many companies are now focusing on vendor risk management, aligning with global privacy laws like the GDPR [2].
  • California Consumer Privacy Act (CCPA): The CPRA builds upon the CCPA, enhancing consumer data privacy protections in California [1].

Sources

  1. Cookiebot - California Privacy Rights Act - CPRA and CCPA
  2. [ManageEngine](https://www.manageengine.com/log-management/compliance/how-to-comply-with-c

Recent developments

  • — California Attorney General Rob Bonta announced an investigative sweep targeting “surveillance pricing” practices in retail, grocery, and hotel sectors. This signals active enforcement attention on pricing and consumer-profiling practices under California privacy law. (source)
  • — The surveillance-pricing sweep is likely to increase scrutiny of retail, grocery, and hospitality data practices. Industry impact is expected to include tighter review of profiling, dynamic pricing, and related consumer-notice practices. (source)
  • — New California privacy regulations took effect on Jan. 1, 2026, significantly expanding compliance requirements for businesses. The update covers ADMT, risk assessments, and cybersecurity audits, with additional compliance timing nuances for some provisions. (source)
  • — The 2026 regulatory update also formalized requirements for businesses using automated decision-making technology. Businesses must provide notices, allow opt-outs in defined cases, and respond to access requests with meaningful information about the logic and likely outcomes of those processes. (source)
  • — The 2025 regulations also require risk assessments for processing activities presenting significant privacy risks. This is driving broader compliance reviews across industries handling large-scale consumer data. (source)
  • — A set of 2025 amendments to the CCPA/CPRA became effective, including AB 1008 and SB 1223. These changes expanded how personal information is defined and added neural data as a category of sensitive personal information. (source)
  • — A California appellate court allowed the California Privacy Protection Agency to resume enforcement after overturning a lower-court delay. The latest CCPA/CPRA regulations became enforceable immediately, removing a prior pause on enforcement. (source)
  • — AB 947 took effect, extending the definition of sensitive personal information to include citizenship or immigration status. This broadened compliance obligations for businesses handling highly sensitive data. (source)
  • — The California Privacy Protection Agency began enforcing the CPRA on July 1, 2023. The law’s expanded rights include correction, limiting sensitive personal information, and opt-out from automated decision-making technology. (source)
  • — The CPRA became effective, creating a broader California privacy regime alongside the CCPA. It added new consumer rights and imposed new operational obligations on employers and businesses. (source)

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates