US CPRA Compliance

Start by deciding whether the issue affects threshold status, sensitive personal information, sharing or cross-context advertising, GPC, correction rights, data-broker duties, ADMT, risk assessments, cybersecurity audits, or service-provider contracts. The useful answer should name the exact trigger, affected product or process, required action, owner, evidence, and escalation point.

The CCPA, as amended by the CPRA, applies to qualifying for-profit businesses that do business in California and meet one of the statutory thresholds, and it also imposes separate obligations on service providers, contractors, and some related entities. A workable compliance plan should map the business's current privacy notice, request-handling process, opt-out signal handling, and contract terms to those duties so the review is easy to audit.

Ownership should sit with the team that can change notices, rights intake, consent/opt-out interfaces, data sharing, retention, vendor terms, or security evidence, with privacy counsel reviewing edge cases.

Evidence should show threshold calculations, privacy notice language, consumer request handling, GPC processing, sensitive-personal-information controls, service-provider/contractor terms, and risk/cyber/ADMT readiness where applicable.

Most CPRA mistakes happen at the boundary between CCPA and CPRA terminology, sale versus sharing, sensitive personal information, data-broker duties, and draft or phased regulatory requirements.

Review this section before launching a data flow, ad-tech integration, consumer interface, vendor contract, retention rule, risk assessment, or cyber audit control.

Use a CPRA workflow that captures threshold status, data categories, consumer rights, opt-out signals, vendor role, retention logic, risk/cyber/ADMT trigger, owner, and review date.

The output should be a threshold memo, notice update, DSAR workflow, opt-out/GPC implementation record, vendor clause map, risk-assessment intake, or audit evidence pack.