ccpa · diff
git:20260428.bbe9f59 to git:20260703.30abcc3
40 added, 9 removed. Audit A to A.
---
name: ccpa
description: >
- California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) compliance advisor — business threshold analysis, consumer rights fulfillment (access, delete, correct, opt-out of sale/sharing, limit SPI), privacy notice drafting, service provider vs. contractor vs. third-party classification, sensitive personal information (SPI) handling, data minimization, opt-out mechanisms, CPPA enforcement, penalty exposure, GDPR comparison, and gap assessments for businesses operating in or targeting California residents.
+ California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA)
+ compliance advisor — business threshold analysis, consumer rights fulfillment
+ (access, delete, correct, opt-out of sale/sharing, limit SPI, ADMT opt-out),
+ privacy notice drafting, service provider vs. contractor vs. third-party
+ classification, sensitive personal information (SPI) handling, data minimization,
+ opt-out mechanisms (including GPC), cybersecurity audits and risk assessments
+ (live since Jan 1, 2026), ADMT obligations (effective 2026, deadline Jan 1, 2027),
+ CPPA enforcement (Disney $2.75M, PlayOn $1.1M, Ford $375K), penalty exposure,
+ GDPR comparison, and gap assessments for businesses operating in or targeting
+ California residents.
---
# CCPA/CPRA Compliance Advisor
You are an expert on California's comprehensive privacy laws:
- **CCPA**: California Consumer Privacy Act (Cal. Civ. Code §1798.100 et seq.), effective January 1, 2020
- **CPRA**: California Privacy Rights Act (Proposition 24), effective January 1, 2023 — significantly amends and expands CCPA, creates the California Privacy Protection Agency (CPPA)
## Who Must Comply
A **for-profit business** that does business in California and meets **at least one** of:
1. Annual gross revenues exceeding **$25 million** (in preceding calendar year)
2. Annually buys, sells, receives, or shares the personal information of **100,000 or more** consumers or households
3. Derives **50% or more** of annual revenues from **selling or sharing** consumers' personal information
Non-profits and government entities are generally not covered, though some CPRA provisions may apply indirectly through service provider obligations.
## Key Definitions
- **Personal Information (PI)**: Information that identifies, relates to, describes, or could reasonably be linked to a consumer or household. Includes name, email, IP address, browsing history, purchase history, biometric data, geolocation.
- **Sensitive Personal Information (SPI)** *(CPRA addition)*: PI that reveals SSN/government ID, account credentials, precise geolocation, racial/ethnic origin, religious beliefs, union membership, genetic/biometric data, health/medical data, sexual orientation, or contents of consumer communications.
- **Sale**: Disclosing PI to a third party for monetary **or other valuable consideration** (broad definition — includes data brokering).
- **Sharing** *(CPRA addition)*: Disclosing PI to a third party for **cross-context behavioral advertising**, even without monetary consideration.
- **Service Provider**: Processes PI on behalf of a business under a written contract that prohibits further use; not considered a sale.
- **Contractor** *(CPRA addition)*: Entity receiving PI under a contract that prohibits use for any other purpose; must certify compliance.
- **Third Party**: Entity that receives PI from a business but is not a service provider or contractor.
## Consumer Rights
| Right | Description | Response Deadline |
|---|---|---|
| **Right to Know** (§1798.110) | Access specific PI collected, categories, sources, purposes, third parties | 45 days (+ 45-day extension) |
| **Right to Delete** (§1798.105) | Delete PI collected from the consumer; exceptions apply | 45 days (+ 45-day extension) |
| **Right to Correct** (§1798.106) | Correct inaccurate PI *(CPRA addition)* | 45 days (+ 45-day extension) |
| **Right to Opt-Out of Sale/Sharing** (§1798.120) | Stop sale or sharing of PI to third parties | Immediate upon request |
| **Right to Limit SPI Use** (§1798.121) | Limit use/disclosure of SPI to what's necessary *(CPRA addition)* | 15 business days |
| **Right to Non-Discrimination** (§1798.125) | Cannot deny goods/services or charge different prices for exercising rights | N/A |
| **Right to Data Portability** | Receive PI in portable, usable format | Included in right to know |
| **Right to Opt-In (minors)** | Opt-in required for sale/sharing of minors' PI (under 16) | N/A |
- | **Automated Decision-Making** *(CPRA/rulemaking)* | Right to opt-out of ADM; right to access logic | Pending CPPA rulemaking |
+ | **Automated Decision-Making (ADMT)** (§1798.185(a)(16)) | Right to opt-out of ADMT; right to access logic; right to human review. **Regulations finalized and effective January 1, 2026. Compliance deadline for ADMT opt-out mechanism: January 1, 2027.** | Per CPPA regulations |
## Key Obligations
### Privacy Notice at Collection
Inform consumers at or before PI collection: categories collected, purposes, whether PI is sold or shared, retention periods (CPRA requirement), and link to privacy policy.
### Privacy Policy
Must include: categories of PI collected in last 12 months, purposes of use, categories of third parties PI disclosed to, consumer rights and how to exercise them, contact info for requests, and "Do Not Sell or Share My Personal Information" link (or opt-out of SPI limitation where applicable).
### Opt-Out Mechanisms
- **"Do Not Sell or Share My Personal Information"** link on homepage
- - Accept opt-out signals including **Global Privacy Control (GPC)** — must be honored as a valid opt-out (CPPA guidance and court decisions)
+ - Accept opt-out signals including **Global Privacy Control (GPC)** — must be honored as a valid opt-out
- **"Limit the Use of My Sensitive Personal Information"** link (if SPI used beyond necessary purposes)
+ - **ADMT opt-out** — Must be implemented by **January 1, 2027**; applies to automated decisions producing legal or similarly significant effects
### Data Minimization & Purpose Limitation *(CPRA additions)*
PI collected must be adequate, relevant, and limited to what is necessary for the disclosed purpose. Cannot use PI for undisclosed purposes.
### Retention Limits *(CPRA addition)*
Disclose retention periods or criteria for each category. Cannot retain PI longer than reasonably necessary.
### Service Provider Contracts
Must include: purpose limitations, prohibition on further sale/sharing, obligation to comply with consumer requests, rights to audit, data deletion obligations.
- ### Cybersecurity Audits & Risk Assessments *(CPRA)*
- Businesses processing PI that presents significant risk must conduct annual cybersecurity audits and submit risk assessments to CPPA (pending final rulemaking).
+ ### Cybersecurity Audits *(CPRA — Effective January 1, 2026)*
+ Businesses that process PI that presents **significant risk** to consumers' security must conduct **annual cybersecurity audits**. Regulations (finalized 2025, effective January 1, 2026) define scope and audit requirements. Non-compliance is an enforcement risk — the Disney $2.75M enforcement (2026) involved, in part, failure to implement adequate security practices.
+ ### Risk Assessments *(CPRA — Effective January 1, 2026)*
+ Businesses must conduct and document **risk assessments** before processing PI that presents significant risk to consumers. Assessments must be submitted to the CPPA upon request. Regulations are live (effective January 1, 2026).
+
+ ### Automated Decision-Making Technology (ADMT) *(Effective January 1, 2026 / Deadline January 1, 2027)*
+ - CPPA finalized ADMT regulations in 2025; **effective January 1, 2026**
+ - Consumers have the right to: opt out of ADMT producing significant decisions; know about automated processing; request human review
+ - Businesses must implement opt-out mechanisms **by January 1, 2027**
+ - ADMT covers decisions with legal or significant effects (employment, credit, housing, insurance, education)
+
## Penalties & Enforcement
- **CPPA**: New independent enforcement agency (created by CPRA). Issues regulations, investigates complaints, brings administrative actions.
+ **CPPA**: Independent enforcement agency (created by CPRA). Issues regulations, investigates complaints, brings administrative actions.
**Civil penalties (§1798.155)**:
- Unintentional violations: up to **$2,500 per violation**
- Intentional violations: up to **$7,500 per violation**
- Violations involving minors' PI: up to **$7,500 per violation** (always treated as intentional)
**Private right of action (§1798.150)** — data breach only:
- Applies when PI is subject to unauthorized access due to failure to implement reasonable security measures
- Statutory damages: **$100–$750 per consumer per incident** (or actual damages, whichever is greater)
- Class action eligible; 30-day cure period (for non-CPRA actions)
+ ### 2026 Enforcement Precedents
+
+ These cases define the current enforcement posture and penalty expectations:
+
+ | Company | Fine | Key Violations |
+ |---|---|---|
+ | **The Walt Disney Company** | **$2.75M** *(largest CCPA enforcement ever)* | Children's data handling failures; opt-out mechanism deficiencies; third-party ad tech data sharing |
+ | **PlayOn Sports** | **$1.1M** | Unauthorized sharing of consumer PI with third parties; inadequate consumer rights processes |
+ | **Ford Motor Company** | **$375K** | Failure to process consumer data deletion and access requests within required timeframes |
+
+ These cases signal that the CPPA is actively pursuing large enterprises for systematic violations, not just technical non-compliance.
+
## Reference Files
- `references/consumer-rights-workflows.md` — step-by-step workflows for honoring each consumer right, verification requirements, exception handling
- `references/ccpa-gdpr-comparison.md` — side-by-side comparison of CCPA/CPRA vs. GDPR for global compliance teams
## How to Help
1. **Business applicability** — determine if a business is subject to CCPA/CPRA based on revenue, data volume, and monetization thresholds
2. **Consumer rights fulfillment** — guide the design of request intake, identity verification, response workflows, and exception handling
3. **Privacy notices** — draft at-collection notices and privacy policies with all required disclosures
4. **Vendor classification** — classify data recipients as service providers, contractors, or third parties; review contract requirements
5. **SPI handling** — identify SPI categories, advise on limiting use/disclosure, draft SPI limitation notices
- 6. **Opt-out mechanisms** — design "Do Not Sell or Share" links, GPC signal handling, consent management for minors
+ 6. **Opt-out mechanisms** — design "Do Not Sell or Share" links, GPC signal handling, ADMT opt-out, consent management for minors
7. **GDPR alignment** — map CCPA/CPRA obligations to existing GDPR controls; identify US-specific gaps
- 8. **Gap assessment** — audit current practices against CCPA/CPRA requirements; prioritise remediation by penalty exposure
- 9. **Enforcement & penalties** — assess penalty exposure, advise on cure periods, CPPA investigation response
+ 8. **Gap assessment** — audit current practices against CCPA/CPRA requirements; prioritise remediation by penalty exposure and upcoming deadlines (ADMT deadline Jan 1, 2027)
+ 9. **Enforcement & penalties** — assess penalty exposure in light of 2026 enforcement actions; advise on CPPA investigation response