We use privacy-by-default, cookieless analytics.

Optional analytics cookies are used only if you accept them.

Read our Terms of Use and Privacy Policy.

US California Consumer Privacy Act · FAQ index

Questions and answers

Search the answers across this artifact’s FAQ modules. Open any answer in its guide or copy a direct link to share it.

44 questions across 13 modules

Back to FAQ overview
Author
Sorena AI
Published
May 9, 2026
Updated
Oct 15, 2026
Browse 13 FAQ modules

Showing 1–15 of 44 questions

California Data Brokers: CCPA, Registration, and DROP Duties

When does the data-broker definition apply, and what duties follow?

Apply the definition to the entity, not to a product label. Confirm that the entity is a CCPA business, knowingly collects personal information, sells that information to third parties, and lacks a direct relationship with the affected consumers. Then check the statute's exclusions, including specified consumer-reporting, financial, insurance, and health-data activities.

A direct relationship exists when the consumer intentionally interacts with the business, but the exact facts matter. Buying data indirectly, collecting it from public sources, or operating a consumer-facing site does not by itself resolve whether the business has a direct relationship with each affected consumer.

  • Register with CalPrivacy between January 1 and January 31 after each year in which the entity met the data-broker definition.
  • Publish the required prior-year request metrics by July 1 and report them during annual registration.
  • Beginning August 1, 2026, access at least once every 45 days and process each matched deletion or fallback opt-out request within 45 days after receiving it through the platform, subject to statutory exceptions. The two periods can result in up to 90 days from the consumer's submission.
  • Direct associated service providers and contractors to delete covered information or process the required opt-out.
  • Prepare for independent audits beginning January 1, 2028 and every three years thereafter; keep the audit report and related materials for at least six years.
Read answer in guideOpen FAQ module
California Data Brokers: CCPA, Registration, and DROP Duties

Which records prove classification and recurring compliance?

Keep separate evidence for the data-broker classification and for each recurring duty. A registration receipt does not show that requests, vendor instructions, or ordinary CCPA requests were handled.

  • Entity-level definition analysis, direct-relationship evidence, sale mapping, and any relied-on exclusion.
  • Annual registration submission, fee record, public registry entry, and the website privacy page containing required disclosures and metrics.
  • access logs, match results, deletion decisions, statutory exception codes, completion dates, and directions sent to service providers or contractors.
  • Independent audit reports from 2028 onward and proof that reports and related materials are retained for at least six years.
Read answer in guideOpen FAQ module
California Data Brokers: CCPA, Registration, and DROP Duties

Which mistakes confuse CCPA and Delete Act duties?

Do not collapse the two regimes into one generic privacy workflow. The CCPA and Delete Act use related concepts but impose different submissions, dates, system interactions, and records.

  • Assuming that registration satisfies the business's CCPA notice, access, deletion, correction, opt-out, or limit duties.
  • Treating every indirect-data business as a without testing the statutory definition and exclusions.
  • Missing the January registration window, July metrics disclosure, 45-day access cycle, or 2028 audit schedule.
  • Deleting only the broker's copy while failing to direct service providers and contractors as the Delete Act requires.
  • Deleting information covered by an exception without recording the legal basis, or using an exception more broadly than the statute allows.
Read answer in guideOpen FAQ module
California Data Brokers: CCPA, Registration, and DROP Duties

Questions and answers

When is a CCPA business also a California ?

A CCPA business is also a California when it knowingly collects and sells to third parties personal information about a consumer with whom it has no direct relationship, unless a statutory exclusion applies. Test the entity's actual collection, sale, third-party recipients, and consumer relationships; an indirect-data product label or public-source collection alone does not decide the result.

How long does a California have to process a request?

Beginning August 1, 2026, a registered must access at least once every 45 days and process a covered request within 45 days after receiving it through the platform. Because those periods can run consecutively, CalPrivacy tells consumers that deletion may take up to 90 days after submission. A request that cannot be verified must be processed as an opt-out of sale or sharing within the same post-receipt period, subject to statutory limits.

Read answer in guideOpen FAQ module
CCPA Dark Patterns: Rules, Examples, and Review Checklist

How should teams review the complete choice flow?

Review every interface used to obtain CCPA consent or let a consumer exercise a right. The regulations require easy-to-understand communications, plain and straightforward language, and so the interface does not impair the consumer's ability to select the more privacy-protective option.

Intent is not the test. An interface can be a because of its effect even if no one designed it to mislead. Consent gathered through that interface does not satisfy the CCPA.

  • Compare font size, color, contrast, placement, labels, and defaults for each pair of choices.
  • Count the screens, clicks, and time required for each path; the privacy-protective path should not be longer or harder.
  • Use specific labels such as "Decline All" instead of ambiguous controls such as "More Options" when an equivalent accept choice is immediate.
  • Do not use double negatives, unrelated bundled terms, repeated prompts, or a default enrollment in a financial incentive.
  • Test withdrawal, opt-out, and account settings as well as the initial consent screen.
Read answer in guideOpen FAQ module
CCPA Dark Patterns: Rules, Examples, and Review Checklist

What evidence shows the choices worked at release?

Keep evidence that shows what a consumer saw and how each path behaved at release time. A policy alone cannot show the wording, visual hierarchy, number of steps, default state, or whether a preference persisted.

  • Screenshots or recordings of every branch on desktop, mobile, and other supported interfaces.
  • A step count and comparison of the privacy-protective and less privacy-protective paths.
  • Approved copy, accessibility results, default-state tests, and evidence that withdrawal is as easy to find and use.
  • Release version, owner, review date, defects, remediation tickets, and regression tests.
Read answer in guideOpen FAQ module
CCPA Dark Patterns: Rules, Examples, and Review Checklist

Which interface patterns can invalidate consent?

A screen can look balanced in isolation and still be part of a . Review the full sequence, the consequences of each selection, and what happens when a consumer returns later.

  • Making "Accept All" prominent while placing "Decline All" behind a settings screen.
  • Preselecting participation in a financial incentive or using toggles whose on and off states are unclear.
  • Asking the consumer to confirm the privacy-protective choice repeatedly while accepting the other choice immediately.
  • Using a broad terms-of-use acceptance as consent for a separate, narrowly defined processing purpose.
  • Fixing the first screen but leaving cancellation, withdrawal, or opt-out controls harder to use.
Read answer in guideOpen FAQ module
CCPA Dark Patterns: Rules, Examples, and Review Checklist

Questions and answers

What is a under the CCPA?

A is a user interface designed or manipulated with the substantial effect of subverting or impairing consumer autonomy, decisionmaking, or choice. The business's intent is not determinative. If the interface has that effect, agreement obtained through it is not valid CCPA consent.

What is a simple example of a ?

A consent banner can be a when "Accept All" is prominent and immediate but declining requires opening settings, navigating extra screens, or deciphering unclear labels. The result depends on the complete interface, but the regulations require the more privacy-protective path not to be longer than the less protective path.

Read answer in guideOpen FAQ module
CCPA Do Not Sell or Share: Scope and Implementation

How should a business classify transfers and honor opt-outs?

Inventory each disclosure by recipient, data category, purpose, consideration, advertising context, contract, and actual recipient use. A vendor label does not decide the analysis. A service provider or contractor must meet the statutory definition and written-contract restrictions; otherwise the recipient may be a third party.

A business that sells or shares must provide two or more designated opt-out methods suited to how it interacts with consumers. For online collection, those methods include processing a qualifying and providing an interactive form through the required link, alternative link, or privacy policy. A business may omit the link only if it meets every condition for frictionless signal processing; posting a cookie banner alone is not an opt-out method.

The request applies without identity verification, although the business may ask for information reasonably necessary to complete it. Stop covered transfers as soon as feasibly possible and no later than 15 business days, give the consumer a way to confirm completion, notify affected downstream third parties as required, use request data only to comply, and wait at least 12 months before asking the consumer to authorize or again, subject to the regulations.

  • Map browser, app, account, offline, advertising, analytics, and vendor transfers separately.
  • Classify each recipient as a third party, service provider, or contractor from the facts and contract.
  • Offer the required link or compliant alternative and honor Global Privacy Control and other qualifying signals.
  • Propagate the opt-out to tags, audiences, application programming interfaces (APIs), data warehouses, and downstream recipients that can sell or share.
  • Retest after changes to consent tools, advertising partners, identity resolution, or data flows.
Read answer in guideOpen FAQ module
CCPA Do Not Sell or Share: Scope and Implementation

What evidence shows that covered transfers stopped?

Keep transaction-level scope evidence and end-to-end opt-out test results. A homepage link does not prove that advertising tags, server-side transfers, offline systems, and known accounts stopped the covered activity.

  • Transfer inventory with recipient, purpose, consideration, advertising use, role, contract, and classification rationale.
  • Screenshots and versioned copy for the notice, privacy policy, and opt-out link or alternative.
  • Tests showing link and preference-signal requests reach browser, device, known account, offline, and downstream systems as applicable.
  • Request timestamps, completion status, propagation logs, exceptions, failures, remediation, and the date on which re-consent may first be requested.
Read answer in guideOpen FAQ module
CCPA Do Not Sell or Share: Scope and Implementation

Which scope and implementation mistakes defeat an opt-out?

Scope errors usually come from classifying a transfer by vendor name or payment method instead of the recipient, purpose, consideration, advertising context, contract, and actual use.

  • Assuming there is no because no money changes hands, while ignoring other valuable consideration.
  • Ignoring because an advertising transfer is unpaid.
  • Treating every analytics or advertising vendor as a service provider without checking the contract and actual use.
  • Stopping client-side tags but leaving server-side, audience, account, or offline transfers active.
  • Requiring identity verification, account creation, or unnecessary fields before accepting an opt-out.
Read answer in guideOpen FAQ module
CCPA Do Not Sell or Share: Scope and Implementation

Questions and answers

Does a CCPA business need a Do Not Sell or Share link?

A business that sells or shares personal information generally must provide a clear and conspicuous "Do Not Sell or Share My Personal Information" link, an approved alternative link, or the privacy-policy route allowed for a business that processes opt-out preference signals in a fully frictionless manner. The business must still honor qualifying preference signals. A cookie banner by itself is not an acceptable -or- opt-out method.

How quickly must a business honor a CCPA -or- opt-out?

A business must stop selling or the consumer's personal information as soon as feasibly possible and no later than 15 business days after receiving the request. The 15-day period is an outside limit, not a default delay: an advertising system that can stop the transfer immediately must do so immediately. The business must also notify affected downstream third parties as the regulations require and provide a way for the consumer to confirm that the request was processed.

Read answer in guideOpen FAQ module
CCPA Financial Incentives: Notice, Consent, and Data Value

When does the CCPA require a financial incentive notice?

Start with the actual exchange. Identify the personal information the program collects, retains, sells, or shares; the benefit, payment, price, or service difference the consumer receives; and whether the difference is reasonably related to the value that the data provides to the business.

Give the Notice of before the consumer opts in. The notice must summarize the program, describe its material terms and implicated personal-information categories, explain how to opt in and withdraw, state a good-faith estimate of the value of the consumer's data, and explain the calculation method and why the price or service difference is reasonably related to that value. Consent must be prior, affirmative, specific to the program, and revocable at any time.

Section 7081 permits several valuation approaches, including marginal or average value, aggregate value divided by the number of consumers, revenue or profit generated from the data, expenses connected to the data, and the cost of the incentive. A business may use another practical and reasonably reliable good-faith method. The calculation must support the actual benefit or difference offered; naming a method without its inputs and relationship to the program is not enough.

  • Map the benefit to the personal information that creates value for the business.
  • Choose and document a permitted valuation method, the inputs, period, assumptions, and good-faith estimate.
  • Present the material terms before enrollment and keep the choice free of preselected controls or unequal emphasis.
  • Record opt-in consent and make withdrawal available at any time through an easy method.
  • Wait at least 12 months before asking again after a consumer refuses opt-in consent, unless regulations prescribe otherwise.

Does every loyalty or discount program require a CCPA Notice of ?

No. The notice is required when the program is a or price or service difference connected to collecting, selling, sharing, or retaining personal information. A business should map the data required for the program, the benefit offered, and the value the data provides. A discount unrelated to personal information does not become a CCPA financial incentive merely because the business offers a lower price.

What must a Notice of say?

Before enrollment, the notice must give a succinct program summary; the material terms, including the implicated personal-information categories and the value of the consumer's data; instructions for opting in; the right and method to withdraw at any time; a good-faith value estimate; the valuation method; and an explanation of how the price or service difference is reasonably related to that value.

How can a business calculate the value of consumer data?

Section 7081 allows a reasonable, documented, good-faith method using one or more listed measures: marginal value, average value, aggregate value divided by the number of consumers, revenue, expenses, profit, the cost of the incentive, or another practical and reasonably reliable method. Keep the period, inputs, assumptions, calculation, approval, and explanation connecting the result to the actual price or service difference.

Can a consumer leave a CCPA program?

Yes. Prior opt-in consent may be revoked at any time. The notice must explain how to withdraw, and the business should stop the program's data-dependent processing and apply the disclosed withdrawal consequences across the affected systems. If a consumer initially refuses opt-in consent, Civil Code section 1798.125 requires the business to wait at least 12 months before asking again, unless regulations prescribe otherwise.

When is a price or service difference discriminatory under the CCPA?

A difference is prohibited when it penalizes a consumer for exercising a CCPA right unless the difference is reasonably related to the value of that consumer's data. If the business cannot calculate a good-faith value estimate or show that relationship, section 7080 says it must not offer the difference. A difference directly resulting from compliance with state or federal law is not discriminatory under section 7080.

Read answer in guideOpen FAQ module
CCPA Financial Incentives: Notice, Consent, and Data Value

What records connect data value to the actual program?

Keep the commercial analysis, consumer-facing notice, consent event, and live program behavior together. The notice should match the benefit, eligibility, data uses, withdrawal result, and valuation method that the program actually uses.

  • Program terms, eligibility, benefit, covered data, processing purposes, retention, sale or sharing, and withdrawal consequences.
  • Good-faith data-value calculation with method, inputs, assumptions, period, and approval.
  • Versioned notice, enrollment screen, unselected default state, consent timestamp, withdrawal record, and suppression of repeat prompts.
  • Tests showing price and service differences match the approved program and valuation analysis.
Read answer in guideOpen FAQ module
CCPA Financial Incentives: Notice, Consent, and Data Value

Which pricing, enrollment, and withdrawal mistakes create risk?

Classify each discount from the actual exchange. The business must connect the specific difference to the value of the consumer's data and operate the program consistently with the disclosed terms.

  • Calling a loyalty program ordinary pricing without testing whether personal information drives the benefit.
  • Using a revenue estimate with no documented method, inputs, or relationship to the consumer's data.
  • Preselecting enrollment or making refusal less prominent, which can undermine consent.
  • Hiding withdrawal or continuing the data practice after withdrawal.
  • Charging or degrading service after a rights request without a documented, reasonably related price or service difference.
Read answer in guideOpen FAQ module