CPRA
California Consumer Privacy Act / California Privacy Rights Act
Key Facts
Overview
The CPRA (California Privacy Rights Act) is the most comprehensive US state privacy law and the only one with a dedicated enforcement agency, the California Privacy Protection Agency (CPPA). It defines cross-context behavioral advertising via cookies as "sharing" personal information, making cookie-based ad tracking subject to opt-out requirements.
What This Means for Your Website
- A "Do Not Sell or Share My Personal Information" link must be prominently displayed
- You must honor Global Privacy Control (GPC) signals as valid opt-out requests
- Cross-context behavioral advertising via cookies triggers opt-out obligations
- Consumers have rights to know, delete, correct, and port their personal information
- Sensitive data requires opt-in consent or the right to limit use and disclosure
- Under 16: opt-in consent required for sale/sharing. Under 13: verifiable parental consent
- Data minimization limits collection to disclosed purposes
Key Requirements
The CPPA and California AG enforce the CPRA with penalties of $2,500 per unintentional and $7,500 per intentional violation. Consumer requests must be fulfilled within 45 days. There is no mandatory cure period. A limited private right of action exists for data breaches involving unencrypted PI ($100-$750 per consumer). Privacy risk assessments are required for high-risk processing.
How ConsentStack Handles This
ConsentStack automatically detects California visitors and shows a CPRA-compliant opt-out banner with a Do Not Sell or Share link. GPC signals are honored automatically, and consent preferences are recorded for audit compliance.
Penalties
$2,500 per unintentional violation / $7,500 per intentional violation.
Key Requirements
- Do Not Sell or Share My Personal Information link required
- Honor Global Privacy Control (GPC) signals
- Right to know, delete, correct, and port personal information
- Data minimization: collection limited to disclosed purposes
- Privacy risk assessments for high-risk processing
- Service provider and contractor contractual requirements
Notable Provisions
- Dedicated agency (CPPA), unique among US states
- Cross-context behavioral advertising via cookies equals sharing
- First US state law to require honoring GPC signals
Data Subject Rights
Ask a business to delete personal information it collected from you, subject to the exceptions in Section 1798.105(d), and have it tell its service providers and contractors, and the third parties it sold or shared the data with unless that proves impossible or involves disproportionate effort, to delete it too.
Ask a business that maintains inaccurate personal information about you to correct it, which the business must do using commercially reasonable efforts.
Learn the categories of personal information a business collected, sold, shared or disclosed about you, the categories of sources, the business or commercial purpose, and the categories of third parties that received it.
Obtain, free of charge, the specific pieces of personal information a business has collected about you.
Direct a business that sells your personal information to third parties to stop selling it, including through an opt-out preference signal; under the CPPA regulations the business must comply as soon as feasibly possible and no later than 15 business days after the request.
Direct a business to stop sharing your personal information with third parties for cross-context behavioral advertising, whether or not money changes hands; under the CPPA regulations the business must comply as soon as feasibly possible and no later than 15 business days after the request.
Direct a business to limit its use and disclosure of your sensitive personal information to what is needed to provide the goods or services you requested and other permitted uses; under the CPPA regulations it must comply as soon as feasibly possible and no later than 15 business days after the request.
A business may not deny you goods or services, charge you different prices, or give you a different level or quality of service because you exercised your CCPA rights, though it may offer financial incentives reasonably related to the value of your data.
Revoke at any time your opt-in consent to a financial incentive program, and revoke consent you gave a business to ignore your opt-out preference signal as easily as you gave it.
Receive the personal information a business discloses in response to your request in a readily usable and, where technically feasible, machine-readable format that you can transmit to another entity without hindrance.
Authorize another person, including through an opt-out preference signal, to opt out of sale or sharing and to limit use of your sensitive personal information on your behalf; the CPPA regulations also let an authorized agent submit requests to delete, correct or know.
File a complaint with the California Privacy Protection Agency, which may investigate possible violations on a sworn complaint or on its own initiative.
US State Specifics
Other North America Regulations
Frequently Asked Questions
Stay compliant with CPRA
ConsentStack helps you implement Opt-out consent for California, United States automatically.