The California Consumer Privacy Act of 2018 (CCPA) is the statute's name. The California Privacy Rights Act of 2020 (), approved as Proposition 24, amended that statute. Most CPRA amendments became operative on January 1, 2023. For current compliance decisions, cite the relevant section of the CCPA as amended rather than treating CCPA and CPRA as two parallel laws.
Side-by-side comparison
Original CCPA vs CPRA amendments
The left column describes the original 2018 framework. The right column identifies material changes now incorporated into the CCPA.
The original CCPA covered a qualifying for-profit business doing business in California if it exceeded $25 million in annual gross revenue, handled personal information of at least 50,000 consumers, households, or devices, or earned at least 50% of annual revenue from selling consumers' personal information.
The voter materials reproduce and amend the original business definition, including the earlier 50,000-person, household, or device threshold.
The amended test uses annual gross revenue above the statutory threshold, as adjusted under the law; buying, selling, or sharing personal information of 100,000 or more consumers or households; or deriving at least 50% of annual revenue from selling or sharing consumers' personal information. Affiliate, joint-venture, and voluntary-certification routes also require review.
The original CCPA provided rights to know, access, delete, opt out of sale, and receive equal service and price subject to the financial-incentive rules.
The official voter text sets out the pre-amendment CCPA provisions and the CPRA changes to the original core rights.
The added correction, extended opt-out to sharing, and created a right to limit certain uses and disclosures of sensitive personal information. The right to limit is conditional: it does not prohibit every use of sensitive personal information.
Sections 1798.106, 1798.120, and 1798.121 establish correction, sale-or-sharing opt-out, and the conditional right to limit.
Update the privacy notice, request channels, response procedures, and downstream instructions. Do not describe the sensitive-information right as a blanket consent rule.
The official voter text sets out the pre-amendment notice-at-collection provision and the CPRA changes.
The amended law requires collection, use, retention, and sharing to be reasonably necessary and proportionate to a disclosed compatible purpose. Notice at collection must state the intended retention period for each category, or the criteria used to determine it.
Subdivisions (a) and (c) contain retention disclosure and reasonable-necessity and proportionality requirements.
Tie each data category to a specific purpose and retention rule. A privacy notice alone does not prove that systems delete or restrict data on schedule.
The official voter text sets out the pre-amendment recipient definitions and the CPRA changes.
The amended law adds the contractor role and requires agreements with third parties, service providers, and contractors to state limited and specified purposes, require applicable privacy protection, support monitoring, require notice if the recipient can no longer comply, and permit the business to stop and remediate unauthorized use.
The California Attorney General enforced the original CCPA. Consumers had a limited private action for specified security incidents, not a general right to sue for every CCPA violation.
The official voter text sets out the original private-action and Attorney General enforcement provisions and the CPRA changes.
The created the California Privacy Protection Agency, which can investigate and bring administrative enforcement actions. The Attorney General also retains civil enforcement authority. The statute does not provide a general private action for all privacy violations.
These provisions establish the CPPA and its administrative authority; section 1798.155 also addresses administrative and Attorney General enforcement.
Track regulator-facing evidence and security-incident exposure separately. Do not describe every noncompliance issue as creating a consumer damages claim.
The official code displays the current consolidated statutory provisions.
Covered-business thresholds
Original CCPA
The original CCPA covered a qualifying for-profit business doing business in California if it exceeded $25 million in annual gross revenue, handled personal information of at least 50,000 consumers, households, or devices, or earned at least 50% of annual revenue from selling consumers' personal information.
The voter materials reproduce and amend the original business definition, including the earlier 50,000-person, household, or device threshold.
CPRA amendments
The amended test uses annual gross revenue above the statutory threshold, as adjusted under the law; buying, selling, or sharing personal information of 100,000 or more consumers or households; or deriving at least 50% of annual revenue from selling or sharing consumers' personal information. Affiliate, joint-venture, and voluntary-certification routes also require review.
The current definition controls present scope analysis.
Consumer rights
Original CCPA
The original CCPA provided rights to know, access, delete, opt out of sale, and receive equal service and price subject to the financial-incentive rules.
The official voter text sets out the pre-amendment CCPA provisions and the CPRA changes to the original core rights.
CPRA amendments
The added correction, extended opt-out to sharing, and created a right to limit certain uses and disclosures of sensitive personal information. The right to limit is conditional: it does not prohibit every use of sensitive personal information.
Sections 1798.106, 1798.120, and 1798.121 establish correction, sale-or-sharing opt-out, and the conditional right to limit.
Operational implication
Update the privacy notice, request channels, response procedures, and downstream instructions. Do not describe the sensitive-information right as a blanket consent rule.
The official voter text sets out the pre-amendment notice-at-collection provision and the CPRA changes.
CPRA amendments
The amended law requires collection, use, retention, and sharing to be reasonably necessary and proportionate to a disclosed compatible purpose. Notice at collection must state the intended retention period for each category, or the criteria used to determine it.
Subdivisions (a) and (c) contain retention disclosure and reasonable-necessity and proportionality requirements.
Operational implication
Tie each data category to a specific purpose and retention rule. A privacy notice alone does not prove that systems delete or restrict data on schedule.
The official voter text sets out the pre-amendment recipient definitions and the CPRA changes.
CPRA amendments
The amended law adds the contractor role and requires agreements with third parties, service providers, and contractors to state limited and specified purposes, require applicable privacy protection, support monitoring, require notice if the recipient can no longer comply, and permit the business to stop and remediate unauthorized use.
The regulations add detail on service-provider, contractor, and third-party contractual requirements.
Enforcement and private claims
Original CCPA
The California Attorney General enforced the original CCPA. Consumers had a limited private action for specified security incidents, not a general right to sue for every CCPA violation.
The official voter text sets out the original private-action and Attorney General enforcement provisions and the CPRA changes.
CPRA amendments
The created the California Privacy Protection Agency, which can investigate and bring administrative enforcement actions. The Attorney General also retains civil enforcement authority. The statute does not provide a general private action for all privacy violations.
These provisions establish the CPPA and its administrative authority; section 1798.155 also addresses administrative and Attorney General enforcement.
Operational implication
Track regulator-facing evidence and security-incident exposure separately. Do not describe every noncompliance issue as creating a consumer damages claim.
The operative regulations provide the implementation detail needed after the statutory trigger is identified.
1
Section 1
What is the practical answer to CCPA vs CPRA?
Keep one California privacy program. Preserve original CCPA controls for notice, access, deletion, sale opt-out, non-discrimination, and reasonable security, then add the changes that apply to the business's facts.
The main additions are a right to correct inaccurate personal information; an opt-out from sharing for cross-context behavioral advertising; a right to limit certain uses and disclosures of sensitive personal information; purpose, proportionality, and retention limits; stronger contract requirements for recipients; and administrative enforcement by the California Privacy Protection Agency.
Recalculate business scope under the amended thresholds instead of relying on a pre-2023 CCPA assessment.
Map every disclosure as a sale, sharing, a business-purpose disclosure to a service provider or contractor, or another permitted disclosure.
Update request handling for correction and for deletion propagation to service providers, contractors, and relevant third parties.
State retention periods or the criteria used to set them, and keep personal information no longer than reasonably necessary for the disclosed purpose.
Test opt-out signals, notices, links, contracts, and downstream instructions with dated evidence.
Sections 1798.100-1798.199.100 contain the current CCPA text, including the CPRA amendments on correction, sharing, sensitive personal information, proportionality, retention, contracts, and enforcement.
How should a team update its California privacy controls?
Start with the entity and data-flow facts. Confirm that the entity is a covered business, identify the California consumers and households involved, and classify each recipient. A company can be a business for one activity and a service provider, contractor, or third party for another.
Then connect each legal trigger to an owner and evidence. Privacy or legal teams can interpret scope, but product, engineering, marketing, procurement, security, and customer-support owners must be able to change the affected system or process.
Scope evidence: revenue and consumer-or-household calculations, sale or sharing revenue, affiliate relationships, and any claimed exemption.
Rights evidence: intake methods, identity verification, response logs, correction workflows, deletion exceptions, extension notices, and downstream instructions.
Advertising evidence: sale and sharing classification, Global Privacy Control handling, opt-out testing, and records showing that suppressed data is not reintroduced.
Sensitive-data evidence: category and purpose mapping, whether the use falls within permitted purposes, limitation methods, and service-provider instructions.
Contract evidence: limited and specified purposes, required privacy protections, monitoring rights, notice of inability to comply, and stop-and-remediate rights.
Governance evidence: current notices, retention rules, security measures, training, approvals, and the applicable cybersecurity-audit, risk-assessment, or automated-decisionmaking analysis.
The CPPA regulations page provides the operative regulations for notices, consumer requests, opt-out preference signals, consent, and service-provider and contractor controls.
Sections 1798.100, 1798.105-1798.135, and 1798.140 establish the duties, rights, response rules, and actor definitions that the evidence should address.
Official CPPA regulations and rulemaking materials for operational implementation.
The CPPA regulations page provides the operative regulations for notices, consumer requests, opt-out preference signals, consent, and service-provider and contractor controls.
The regulations specify notices and operational methods for requests to correct, opt out, and limit.
Show 3 more
The regulations explain how notices and purpose limitations operate in practice.
The regulations add detail on service-provider, contractor, and third-party contractual requirements.
The operative regulations provide the implementation detail needed after the statutory trigger is identified.
Current official statutory text for CCPA scope, rights, duties, definitions, exemptions, remedies, and CPPA authority.
Sections 1798.100-1798.199.100 contain the current CCPA text, including the CPRA amendments on correction, sharing, sensitive personal information, proportionality, retention, contracts, and enforcement.
Sections 1798.100, 1798.105-1798.135, and 1798.140 establish the duties, rights, response rules, and actor definitions that the evidence should address.
Show 1 more
The current consolidated statute is the controlling starting point for present California privacy decisions.