US CPRA Enforcement Advisories

CPPA Enforcement Advisories discuss selected CCPA statutes and regulations and show issues the Enforcement Division is watching. They do not implement or interpret the law, establish substantive policy or rights, constitute legal advice, reflect the Board's views, or provide a safe harbor. The statute and regulations control if an advisory appears to conflict with them, and the Enforcement Division makes case-by-case decisions.

Use an advisory as an enforcement-priority and control-review signal. Advisory 2024-01, issued April 2, 2024, applies data minimization to consumer requests and warns against excessive verification data. Advisory 2024-02, issued September 4, 2024, addresses dark patterns, plain language, and symmetry in privacy choices. Advisory 2025-01 addresses timely and complete data-broker registration, including separate registrations for qualifying subsidiaries and accurate trade names and websites.

For each relevant advisory, identify the binding provision it cites, then compare the actual facts with both the rule and the advisory's hypothetical. For 2024-01, test what information each request path collects and why it is necessary. For 2024-02, compare the time, steps, wording, and visual treatment for privacy-protective and less protective choices. For 2025-01, test each legal entity's registration, payment, trade names, websites, and DROP account. Assign an owner and record the legal source, factual comparison, decision, remediation, and retest date.

Keep the advisory number and publication date, the binding provisions it cites, an inventory of affected interfaces or processing, screenshots or tests of current behavior, the factual comparison, the gap decision, remediation ticket, owner approval, and dated retest. Preserve the version reviewed because a later enforcement action or guidance document may address the topic differently.

Common failures include treating an advisory as binding law, assuming it offers a safe harbor, copying a hypothetical conclusion without matching the facts, citing only the advisory instead of the underlying rule, or updating policy text without fixing the interface, request workflow, or registration record at issue.