CCPA, as amended by the CPRA
California's privacy law: residents can ask what you collected, demand deletion, and opt out of you selling or sharing it with ad platforms.
See it
What it is
The CCPA took effect in 2020 and the CPRA rewrote big chunks of it from 2023, so the current law is one thing with two names. It gives California residents the right to know what you collected, delete it, correct it, opt out of the 'sale' or 'sharing' of it, limit how you use sensitive personal information, and not get a worse product for asking. It applies to for-profit businesses that do business in California and clear one of three thresholds: gross annual revenue above an inflation-adjusted figure that the CPPA re-indexes (26,625,000 dollars for 2025 and 2026, so check the current number rather than quoting the old 25 million), annually buying, selling, or sharing the personal information of 100,000 or more consumers or households (that is traffic in the data, not merely holding it), or half or more of your revenue from selling or sharing personal information.
The mental model tilts differently from GDPR's. GDPR asks you to justify processing before you start; California leans harder on notice and exit rights. Leans, not shrugs: the amended law also demands purpose limitation, data minimization, disclosed retention periods, and specific contract terms with service providers, contractors, and third parties. The exit has to be real too: a 'Do Not Sell or Share My Personal Information' link, a Notice at Collection shown at or before the moment you collect, and automatic honoring of the Global Privacy Control signal that some browsers and extensions send.
Gotcha: 'we don't sell data' is almost always wrong. 'Sale' and 'sharing' are defined broadly enough that a Meta pixel or a Google Ads tag passing identifiers to a third party for cross-context behavioral advertising counts, no money required. Sephora paid 1.2 million dollars in 2022 largely for exactly that plus ignoring Global Privacy Control. Also note the enforcer changed: California now has a dedicated agency, the CPPA, that writes rules and audits, not just an attorney general with a long queue.
Ask AI for it
Audit this web product for CCPA/CPRA compliance and generate what is missing. Step one: list every third-party script, pixel, and SDK that receives a user identifier (cookie ID, device ID, hashed email, IP), then classify each disclosure against the statutory definitions of 'sale' and 'sharing', the applicable exceptions, the recipient's role, whether the purpose is cross-context behavioral advertising, and what the actual contract says. Mark uncertain cases for counsel rather than presuming a classification in either direction. Step two: produce the artifacts. A Notice at Collection shown at or before collection, listing categories collected, purposes, retention periods, and whether each category is sold or shared. A 'Do Not Sell or Share My Personal Information' footer link on every page, wired to a preference page with a per-purpose toggle that works without an account. A Global Privacy Control handler that reads navigator.globalPrivacyControl and the Sec-GPC request header and suppresses the ad tags before they load, not after. A request intake flow for know, delete, correct, and limit, with a 45-day response clock and identity verification that collects no new data. Output a checklist of what already exists, what is missing, and the file to change for each.