--------------------------- Title: Overview of the California Privacy Rights Act (CPRA) URL: https://www.cookiebot.com/us/cpra/ --------------------------- # Overview of the California Privacy Rights Act (CPRA) This guide breaks down CPRA and CCPA obligations for U.S. and global businesses with California visitors and customers. It covers consumer rights, business thresholds, and how CPRA fits into the wider U.S. privacy law patchwork, including the separate litigation risk posed by the California Invasion of Privacy Act (CIPA). ## At a Glance - CPRA amended and expanded the CCPA; both have been fully in effect since January 1, 2023, with new automated decision-making, risk assessment, and cybersecurity audit rules phasing in through 2030. - Applies to businesses meeting any one of three thresholds: over $26,625,000 in annual revenue, buying, selling, or sharing 100,000 or more consumers' personal information per year, or deriving 50 percent or more of revenue from selling or sharing personal information. - If your business already tracks the CPA, CTDPA, TDPSA, or other state privacy laws, CPRA adds California-specific consumer rights and a dedicated enforcement agency on top of that patchwork, not a separate compliance program. - Enforced by the California Privacy Protection Agency (CalPrivacy), with civil penalties up to $7,988 per violation and a narrow private right of action limited to certain data breaches. - The California Invasion of Privacy Act (CIPA), a separate 1967 wiretapping law, drives a large share of active California privacy litigation and applies regardless of your CPRA or CCPA compliance status. - Starting 2027, the California Opt Me Out Act adds a browser-level opt-out signal requirement on top of the Global Privacy Control (GPC) signals businesses must already honor today. If your website already tracks other state privacy laws, CPRA won't feel unfamiliar in shape, but it has added requirements found in few other states. These include a stricter sensitive information category, a dedicated regulator, and rules that keep expanding through 2030. This guide covers what the law requires, who it applies to, and where it fits alongside the rest of your compliance program, including CIPA, a separate litigation risk that CCPA and CPRA compliance doesn't touch. ## What Is CPRA? The California Privacy Rights Act (CPRA) is a California ballot initiative, passed by voters as Proposition 24 on November 3, 2020. It amends and expands the [California Consumer Privacy Act (CCPA)](https://www.cookiebot.com/us/what-is-ccpa/), which took effect January 1, 2020 as the first comprehensive state privacy law in the U.S. CPRA didn't replace the CCPA. It strengthened it, adding new consumer rights, a stricter category for sensitive personal information, and the [California Privacy Protection Agency (CalPrivacy)](https://www.cookiebot.com/en/escalating-cppa-enforcement/) as a dedicated enforcement body. CPRA became fully operative on January 1, 2023, with CalPrivacy enforcement beginning July 1, 2023. For a U.S. business, the practical takeaway is that "CPRA compliance" and "CCPA compliance" describe the same underlying obligation. CPRA is the current, fuller version of California's privacy law, not a separate one layered alongside the original. ### Key Dates for U.S. Compliance Teams The CPRA's legislative history runs back to a 2020 ballot initiative, but these are the dates that matter for a compliance program today. - **January 1, 2023**: CPRA becomes fully operative. - **July 1, 2023**: CalPrivacy enforcement begins. - **January 1, 2025**: SB 1223 and AB 1008 add neural data to the sensitive personal information (SPI) category. - **January 1, 2026**: Finalized CalPrivacy regulations on automated decision-making, risk assessments, and cybersecurity audits take effect. - **January 1, 2027**: ADMT significant-decision requirements begin (pre-use notice, opt-out, and appeal rights); the California Opt Me Out Act's browser-level signal mandate also takes effect. - **April 1, 2028 through April 1, 2030**: Cybersecurity audit deadlines phase in by revenue tier. ## What's the Difference Between the CCPA and CPRA? Asking about CCPA and CPRA compliance is asking about one regulation, not two separate ones. A number of other states have passed amendments to their privacy laws, but most have not passed full additional regulations to augment active ones. The CPRA raised what compliance with California's privacy law requires, but didn't create a second, parallel standard to check against. Companies that achieved CCPA compliance would need to meet updated or new requirements that the CPRA brought in if they hadn't updated their compliance operations. ## CPRA Consumer Rights for Websites CPRA gives California consumers four new rights and expands five existing ones. Your website needs to support consumers exercising these through a verified request. ## CPRA Consumer Rights - **Right to correct (new)** — Request correction of inaccurate personal or sensitive personal information. - **Right to opt out of automated decision-making (new)** — Object to personal or sensitive personal information being used for automated inferences, including profiling for targeted advertising. - **Right to know about automated decision-making (new)** — Request access to information about how automated decision-making technology works and its likely outcomes. - **Right to limit use of sensitive personal information (new)** — Restrict how a business uses sensitive personal information, particularly around third-party sharing. - **Right to delete (expanded)** — Businesses must now notify third parties to delete personal information as well. - **Right to know (expanded)** — Access personal information collected beyond the CCPA's original 12-month window. - **Right to opt out (expanded)** — Opt out of the sale and sharing of personal information for behavioral advertising, not only its sale. - **Right to opt out for minors (expanded)** — Opt-in consent is required to share, not just sell, a minor's personal information for behavioral advertising. - **Right to data portability (expanded)** — Request that personal information be transferred to another business or organization. Two links need to be visible on your website for consumers to exercise these rights directly: "[Do Not Sell or Share My Personal Information](https://usercentrics.com/guides/website-disclaimers/do-not-sell-my-personal-information/)" and "[Limit the Use of My Sensitive Personal Information](https://usercentrics.com/guides/website-disclaimers/limit-the-use-of-my-sensitive-personal-information/)." There's no general private right of action for most CPRA violations. Enforcement sits with CalPrivacy, with a narrow private right of action limited to certain data breaches involving unencrypted personal information. ## Does CPRA Apply to Your Business? A business is covered if it meets any one of three thresholds: - Annual gross revenue over USD 25 million (adjusted to USD 26,625,000 for inflation, with the next adjustment in 2027) - Buying, selling, or sharing the personal information of 100,000 or more California consumers or households per year - Deriving 50 percent or more of annual revenue from selling or sharing personal information Selling or sharing a minor's personal information carries its own consent rule separate from these thresholds. Opt-in consent from the minor for ages 13 to 15, and from a parent or guardian for anyone under 13. ### Sensitive Personal Information (SPI) SPI is a stricter category covering health data, precise geolocation, biometric and genetic data, race, religion, and sexual orientation. SB 1223 added neural data to that list in 2025. Websites need a way for consumers to limit how their SPI is used, typically through the "Limit the Use of My Sensitive Personal Information" link alongside the "Do Not Sell or Share" link. ### Consumers' **Opt-Out Rights and Behavioral Advertising** Requirements California consumers can specifically opt out of cross-context behavioral advertising in addition to the sale or sharing of their data. Non-personalized advertising is treated differently, and opt-out is not required. ## Honoring Global Privacy Control (GPC) Signals The requirement to honor an opt-out preference signal, most commonly implemented as [Global Privacy Control (GPC)](https://www.cookiebot.com/us/global-privacy-control/), came in through CPRA-driven regulations rather than the original 2020 CCPA. When a visitor's browser sends a GPC signal, it's treated as a valid request to opt out of the sale or sharing of their personal information, with the same effect as if they'd clicked the "Do Not Sell or Share" link directly. As of January 1, 2026, revised CCPA regulations made it mandatory for businesses to confirm back to the consumer that the signal was received and honored. Previously this was discretionary. California, Colorado, and Connecticut have also run a [joint investigative sweep](https://cppa.ca.gov/announcements/2025/20250909.html) targeting businesses that fail to honor GPC, so this isn't a dormant requirement to leave for later. ## Enforcement and Penalties CalPrivacy and the California Attorney General share enforcement authority. CalPrivacy can't limit the Attorney General's authority and must pause its own proceedings if the AG asks. CalPrivacy also adjusts penalty amounts every two years in line with the Consumer Price Index, with the next adjustment due in 2027. - **Civil penalties:** Up to USD 2,663 per unintentional violation and USD 7,988 per intentional violation or one involving a minor's data - **Private right of action:** Limited to data breaches involving unencrypted or unredacted personal information resulting from a business's failure to maintain reasonable security measures - **Cure period:** Consumers must give businesses 30 days to fix the issue and confirm no future violations before suing - **Consumer damages:** USD 107 to USD 799 per incident, or actual damages, whichever is greater ## The California Opt Me Out Act Starting January 2027, browsers used in California must include a built-in setting that sends an opt-out preference signal to websites, and businesses must honor it. Businesses already need to honor [Global Privacy Control (GPC)](https://www.cookiebot.com/us/global-privacy-control/) signals today. The Opt Me Out Act adds a browser-level mandate on top of that requirement, rather than replacing it. ## ADMT Requirements Taking Effect in 2027 Starting January 1, 2027, businesses using automated decision-making technology (ADMT) to make a "significant decision" about a consumer, covering things like employment, lending, housing, healthcare, or education, have new obligations to meet. You'll need to give consumers a pre-use notice, in plain language, before using ADMT to make that kind of decision. Consumers can opt out of the ADMT use itself, and can request access to information about how the technology worked and what it based its decision on. The final regulations narrowed this scope considerably from earlier drafts: it applies only to technology that substantially replaces human decision-making, not automated tools generally, and the rules were rewritten to avoid referencing AI directly. Cybersecurity audits and risk assessment certifications are a separate, later-arriving set of obligations rather than part of this 2027 deadline. Businesses over USD 100 million in revenue face their first certification deadline in April 2028, with smaller businesses phased in through April 2030. ## CIPA: The Litigation Risk CPRA Compliance Doesn't Cover The [California Invasion of Privacy Act (CIPA)](https://www.cookiebot.com/us/cipa-california-invasion-of-privacy-act/) is a separate, much older law that a CPRA or CCPA-compliant setup does nothing to address. Passed in 1967 as a wiretapping statute, CIPA has increasingly been applied by plaintiffs to ordinary website tools such as pixels, session replay, and chat widgets. By legislative estimates, pen-register and trap-and-trace claims under CIPA §638.51 alone account for roughly two-thirds of active California privacy litigation. Filings under that section grew from around 600 in early 2025 to nearly 4,000 by the time reform legislation cleared the state legislature in August 2026. CIPA carries statutory damages of USD 5,000 per violation or three times actual damages, whichever is greater, with no requirement to show actual harm. This is why [demand letters](https://www.cookiebot.com/us/understand-and-respond-to-cipa-demand-letter/) citing it have become common even against ordinary commercial sites. Governor Newsom signed the reform bill, SB 690, on September 30, 2026. From January 1, 2027, it moves enforcement of the pen register and trap-and-trace theory (§ 638.51) to the California Attorney General only, removing the private right of action for that claim over website and app conduct. It also applies retroactively to pending § 638.51 claims in actions filed on or after January 1, 2025. It does not touch CIPA's § 631 or § 632 wiretapping and eavesdropping provisions, which remain available to private plaintiffs. CIPA sits entirely outside CPRA's own requirements, but for any U.S. business managing consent on a California-facing website, it's a live, separate source of exposure worth addressing on its own terms. ## How Cookiebot™ CMP Supports CPRA Privacy Compliance California won't be the last state to rewrite its privacy rules, and CPRA won't be the last set of obligations layered onto CCPA's original framework. The ADMT requirements landing in 2027, the Opt Me Out Act's browser mandate, and whatever CalPrivacy's next rulemaking cycle produces are all reasons to think of CPRA compliance as ongoing maintenance rather than a box to check once. Cookiebot™ CMP is built around that reality. The scanner enables you to maintain an current inventory of the cookies and trackers actually running on your site (and as they change over time), geotargeting applies the right consent experience based on where each visitor is, and the setup adjusts your tracking and regulatory requirements evolve. A consent banner that handles CPRA and CCPA well has nothing to do with CIPA exposure and whether a pixel or a chat widget on your site could be read as a pen register. That's a separate risk, worth its own review, regardless of how solid your privacy compliance program already is. Similar laws in other states, and the federal [Video Privacy Protection Act (VPPA)](https://usercentrics.com/us/knowledge-hub/video-privacy-protection-act-vppa/) and [Electronic Communications Privacy Act (ECPA)](https://www.cookiebot.com/us/electronic-communications-privacy-act-ecpa/), are being included alongside CIPA claims. Cookiebot provides the [CIPA Consent Template](https://www.cookiebot.com/us/cipa-vppa-cookiebot-configuration/) in the CMP to support those requirements. Manage CCPA and CPRA compliance without the guesswork Cookiebot CMP scans your site, detects trackers, and shows the right consent experience to every visitor. Set it up in minutes and support your California privacy compliance from day one. [Start Free Trial](https://admin.cookiebot.com/signup?lang=en) ## Preamble This guide breaks down CPRA and CCPA obligations for U.S. and global businesses with California visitors and customers. It covers consumer rights, business thresholds, and how CPRA fits into the wider U.S. privacy law patchwork, including the separate litigation risk posed by the California Invasion of Privacy Act (CIPA). ## Summary This guide breaks down CPRA and CCPA obligations for U.S. and global businesses with California visitors and customers. It covers consumer rights, business thresholds, and how CPRA fits into the wider U.S. privacy law patchwork, including the separate litigation risk posed by the California Invasion of Privacy Act (CIPA). --- ## Footer ### Products - [Cookiebot™ Consent Solution](https://www.cookiebot.com/us/cookie-consent-solution/) - [Audience Survey](https://www.cookiebot.com/us/audience-survey-add-on/) - [Usercentrics for Wix](https://www.cookiebot.com/us/cookiebot-for-wix-by-usercentrics-app/) - [Usercentrics Cookiebot plugin for WordPress](https://www.cookiebot.com/us/new-wp-cookie-plugin/) - [Cookiebot CMP for Shopify](https://www.cookiebot.com/us/cookiebot-cmp-for-shopify/) - [Cookie checker](https://www.cookiebot.com/us/cookie-checker/) - [Usercentrics products](https://usercentrics.com/us/) - [Pricing](https://www.cookiebot.com/us/pricing/) ### Regulations - [DMA (EU)](https://www.cookiebot.com/us/digital-markets-act-dma/) - [GDPR (EU)](https://www.cookiebot.com/us/gdpr/) - [CCPA (California)](https://www.cookiebot.com/us/what-is-ccpa/) - [VCDPA (Virginia)](https://www.cookiebot.com/us/virginia-vcdpa/) - [LGPD (Brazil)](https://www.cookiebot.com/us/lgpd/) - [TCF v2.4 (IAB)](https://www.cookiebot.com/us/tcf/) - [Google Consent Mode (EU)](https://www.cookiebot.com/us/cookiebot-cmp-google-consent-mode/) - [Microsoft UET Consent Mode](https://www.cookiebot.com/us/microsoft-consent-mode-cmp/) - [View all regulations](/us/regulations-and-frameworks/#united-states-state&united-states-federal) ### Partners - [Become an affiliate](https://www.cookiebot.com/us/affiliates/) - [Affiliate Login](https://app.impact.com/login.user) - [Become a partner](https://www.cookiebot.com/us/resellers/) - [Find a partner](https://www.cookiebot.com/us/cookiebot-reseller/) ### Resources - [Blog](https://www.cookiebot.com/us/blog/) - [Customer stories](https://www.cookiebot.com/us/customer-stories/) - [Customer directory](https://www.cookiebot.com/us/cookiebot-customer-directory/) - [Digital Markets Act Hub](https://www.cookiebot.com/us/digital-markets-act-dma-resources/) - [Google Consent Mode Hub](https://www.cookiebot.com/us/google-consent-mode-resources/) - [Google Consent Mode V2 certification](https://courses.usercentrics.com/course/google-consent-mode-v2) - [Google Consent Audit Fixes](https://www.cookiebot.com/us/google-consent-audit-fixes/) - [Cookie Banner Cost Calculator](https://www.cookiebot.com/us/cookie-banner-pricing-calculator/) ### Company - [About us](https://www.cookiebot.com/us/about/) - [Careers](https://usercentrics.com/career/) - [Support](https://support.cookiebot.com/hc/en-us/) - [Developer documentation](https://www.cookiebot.com/us/developer/) ©2026 Cookiebot. All rights reserved. Cookiebot is a trademark of Usercentrics A/S. Usercentrics A/S is registered in Denmark. Company reg. no.: 34624607. Do Not Sell or Share My Personal InformationData Subject RequestsManage Your Preferences [Privacy Policy](https://www.cookiebot.com/us/privacy-policy/) · [Terms of Service](/en/terms-of-service/) · [Cookie Declaration](https://www.cookiebot.com/us/cookie-declaration/) · [Data Processing Agreement](/us/data-processing-agreement/) · [Legal Notice](https://www.cookiebot.com/us/legal-notice/) · [Accessibility Statement](/en/accessibility-statement-wcag-compliance/)