California CPRA FAQ

Start with entity coverage. A for-profit entity doing business in California is a CCPA business if it determines the purposes and means of processing and meets at least one statutory test: the current adjusted gross-revenue threshold, buying, selling, or sharing the personal information of at least 100,000 consumers or households in a year, or deriving at least 50% of annual revenue from selling or sharing consumers' personal information. Parent, subsidiary, joint-control, nonprofit, sectoral, and data-specific rules can change the result, so document the legal entity and data flow before applying a control.

Next identify the action: notice at collection; a request to know, delete, or correct; an opt-out of sale or sharing; a Global Privacy Control signal; a request to limit sensitive personal information; a vendor-role contract; retention; or a newer cybersecurity audit, risk assessment, or ADMT duty. For ADMT used to make a significant decision, identify the separate pre-use notice, opt-out, access, and any human-appeal path. The CPRA is an amendment to the CCPA, while the Delete Act's data-broker registry and DROP duties come from a separate California title.

Name the exact trigger, consumer or data category, responsible business process, deadline, owner, downstream recipients, evidence, and escalation point. Use the detailed FAQ for the selected issue rather than applying one answer across unrelated rights.

Assign operational ownership to the team that can change the relevant system: privacy operations for request intake, product and engineering for interfaces and preference signals, procurement and legal for recipient contracts, data owners for retention, and security leadership for audits. Privacy counsel should review coverage, exemptions, denials, and other legal interpretations.

Consumer requests to delete, correct, know, access ADMT, or appeal ADMT generally require confirmation within 10 business days and a response within 45 calendar days, with one explained extension of up to 45 additional days when allowed. The response period starts when the business receives the request, regardless of verification time. Sale-or-sharing opt-outs, ADMT opt-outs, and sensitive-information limitation requests follow different rules, including a 15-business-day outer limit for stopping the covered processing and sending required downstream instructions. Keep each clock tied to the correct request type.

Evidence should show the coverage analysis, collection notices, request handling, GPC processing, sensitive-information purpose mapping, recipient contracts, retention controls, and any risk-assessment, cybersecurity-audit, or ADMT readiness work that the actual processing triggers.

Do not treat a sectoral or data-specific exemption as an entity-wide exclusion unless the statute says it is one. Publicly available information, deidentified information, employee records, business contacts, regulated financial or health data, and data handled by government bodies each require the exact statutory definition and facts. The temporary employee and business-contact exemptions expired after 2022, so current employment and business-contact processing cannot be excluded on that historical basis.

Reassess before a material change to the data, purpose, interface, vendor, recipient role, system logic, or law. In particular, distinguish selling from sharing for cross-context behavioral advertising, a service provider from a third party, and a sensitive-data use that is limitable from one allowed by section 7027(m). A Global Privacy Control signal applies at least to the browser or device that sends it and must also reach a known account when the business can associate the signal with that consumer.

Use one intake that captures entity coverage, data categories and purposes, consumer right, opt-out signal, recipient role, retention logic, cybersecurity-audit, risk-assessment and ADMT triggers, owner, deadline, and review date.

The result should be a specific record: a coverage memo, notice update, consumer-request workflow, opt-out and GPC test record, sensitive-information purpose map, vendor clause map, retention schedule, risk assessment, ADMT rights package, or cybersecurity-audit evidence pack.