We use privacy-by-default, cookieless analytics.

Optional analytics cookies are used only if you accept them.

Read our Terms of Use and Privacy Policy.

Artifact GuideUSEnforcement Advisories

US CPRA Enforcement Advisories

CPPA identify issues the Enforcement Division is examining, but they do not create rights, duties, safe harbors, or binding interpretations.

Apply the cited California statute and regulations to the actual entity, data flow, system, and recipient role; escalate unresolved legal interpretation.

Back to main artifactReview sources
Author
Sorena AI
Published
May 9, 2026
Updated
Jul 24, 2026
3 sections5 primary sources
Overview

are nonbinding documents from the California Privacy Protection Agency's Enforcement Division. They identify selected provisions of the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), enforcement observations, and hypothetical review questions, but they do not create rights, safe harbors, or alternative compliance routes. This page explains how to separate each advisory from the binding statute and regulations and turn it into a fact-specific control review.

Search this module

Find a question or answer quickly

3 of 3 questions
Question 1

What enforcement and penalty risks should teams plan for under the US CPRA?

CPPA discuss selected CCPA statutes and regulations and show issues the Enforcement Division is watching. They do not implement or interpret the law, establish substantive policy or rights, constitute legal advice, reflect the Board's views, or provide a safe harbor. The statute and regulations control if an advisory appears to conflict with them, and the Enforcement Division makes case-by-case decisions.

Use an advisory as an enforcement-priority and control-review signal. Advisory 2024-01, issued April 2, 2024, applies data minimization to consumer requests and warns against excessive verification data. Advisory 2024-02, issued September 4, 2024, addresses , plain language, and symmetry in privacy choices. Advisory 2025-01 addresses timely and complete data-broker registration, including separate registrations for qualifying subsidiaries and accurate trade names and websites.

For each relevant advisory, identify the binding provision it cites, then compare the actual facts with both the rule and the advisory's hypothetical. For 2024-01, test what information each request path collects and why it is necessary. For 2024-02, compare the time, steps, wording, and visual treatment for privacy-protective and less protective choices. For 2025-01, test each legal entity's registration, payment, trade names, websites, and DROP account. Assign an owner and record the legal source, factual comparison, decision, remediation, and retest date.

  • Label the advisory as nonbinding enforcement guidance and identify the binding statute or regulation separately.
  • Test the actual consumer journey or registration record rather than treating a policy edit as remediation.
  • Escalate fact-specific legal interpretation; an advisory does not determine whether a particular practice violates the CCPA.
Question 2

What evidence should teams keep for Enforcement Advisories under the US CPRA?

Keep the advisory number and publication date, the binding provisions it cites, an inventory of affected interfaces or processing, screenshots or tests of current behavior, the factual comparison, the gap decision, remediation ticket, owner approval, and dated retest. Preserve the version reviewed because a later enforcement action or guidance document may address the topic differently.

  • Authority record: advisory number, issue date and saved version, each cited statute or regulation, and a note that the advisory is nonbinding Enforcement Division guidance.
  • Fact record: affected legal entities, interfaces or request flows, inputs collected, choice-path steps, trade names and websites, screenshots, test data, and the differences from the advisory's hypothetical.
  • Decision record: control owner, legal and product review, remediation ticket, implementation evidence, dated retest, unresolved factual or legal issue, and the trigger for another review.
Question 3

Which mistakes create risk when handling Enforcement Advisories under the US CPRA?

Common failures include treating an advisory as binding law, assuming it offers a safe harbor, copying a hypothetical conclusion without matching the facts, citing only the advisory instead of the underlying rule, or updating policy text without fixing the interface, request workflow, or registration record at issue.

  • Quoting an advisory without identifying the statute or regulation that creates the duty.
  • Treating a hypothetical example as a conclusion about a product with different facts.
  • Changing policy language while leaving the interface, request flow, or registration record unchanged.
Recommended next step

Turn US CPRA Enforcement Advisories into assigned work

This US CPRA guide turns Enforcement Advisories into owners, evidence requests, review checkpoints, and reusable operating records in Sorena.

Assessment workflow
Open Assessment Autopilot for US CPRA

Turn Enforcement Advisories into scoped questions, evidence fields, and review tasks.

Explore next step
Research workflow
Review US CPRA source evidence

Use Research Copilot to answer follow-up questions with cited source material.

Explore next step
Talk to Sorena
Talk through implementation

Review scope, evidence, owners, and the next compliance actions with Sorena.

Explore next step
Primary sources

References and citations

Enforcement Advisory 2024-02 - Avoiding Dark Patterns
cppa.ca.gov4 citations
Referenced sections
  • CPPA Enforcement Division guidance on clear language, symmetry in choice, and the nonbinding status of enforcement advisories.
  • CPPA Enforcement Division guidance supporting the September 4, 2024 issue date and review questions about plain language and symmetrical privacy choices.
  • The advisory explains how the Enforcement Division evaluates clear language and symmetry in privacy choices and states the limits of enforcement advisories.
Show 1 more
  • The advisory states that advisories do not establish substantive policy or rights and that statutes and regulations control.
"Advisories do not implement, interpret, or make specific the law enforced or administered by the California Privacy Protection Agency"
Enforcement Advisory 2024-01 - Applying Data Minimization to Consumer Requests
cppa.ca.gov2 citations
Referenced sections
  • CPPA Enforcement Division guidance on applying data minimization to consumer-right requests and limiting unnecessary verification data.
  • CPPA Enforcement Division guidance supporting the data-minimization and consumer-request examples, its April 2, 2024 issue date, and the limits on advisory legal effect.
Enforcement Advisory 2025-01 - Data Broker Registration
cppa.ca.gov2 citations
Referenced sections
  • CPPA Enforcement Division guidance on timely and complete data-broker registration, trade names, websites, and separate legal entities.
  • CPPA Enforcement Division guidance supporting the checks for complete registration, separate legal entities, trade names, websites, and DROP accounts.
California Privacy Protection Agency FAQ
cppa.ca.gov
Referenced sections
  • Official background on the CPRA amendments to the CCPA; it does not establish the status or effect of Enforcement Advisories.
"The CPRA amended the CCPA by adding additional consumer privacy rights and obligations for businesses"
CPPA Enforcement Division Issues First Advisory
cppa.ca.gov
Referenced sections
  • Official CPPA source explaining that enforcement advisories share observations with regulated businesses and encourage CCPA compliance.
"Enforcement Advisories share observations with the regulated community to further compliance with the California Consumer Privacy Act"

Related guides

California Delete Act data broker registry and DROP guide

California Delete Act guidance for the data broker registry and Delete Request and Opt-Out Platform (DROP), with owners, evidence, and official sources.

CPRA Global Privacy Control (GPC): opt-out requirements and enforcement FAQ

US CPRA guidance for GPC, with practical decisions, evidence, edge cases, and external source citations.

What counts as sharing under the California CPRA?

How to identify sharing for cross-context behavioral advertising and implement California notice, opt-out, preference-signal, contract, and recordkeeping duties.

What should teams do about ADMT under the US CPRA?

Decide whether California's ADMT rules cover an automated decision, then apply the 2027 notice, access, opt-out, appeal, and evidence requirements.

What should teams do about Contract Terms under the US CPRA?

Classify California data recipients and check the required service-provider, contractor, third-party, subcontractor, monitoring, and remediation terms.

What should teams do about Correction Rights under the US CPRA?

Handle California correction requests with proportionate verification, 10-business-day confirmation, 45-calendar-day response, accuracy review, and downstream corrections.

Show all related guides (39)

What should teams do about Cybersecurity Audits under the US CPRA?

US CPRA guidance for Cybersecurity Audits, with practical decisions, evidence, edge cases, and external source citations.

What should teams do about retention under the California CPRA?

California CPRA guidance for retention, including data minimization, privacy policy disclosures, evidence records, and official source citations.

What should teams do about Sensitive Personal Information Limits under the US CPRA?

US CPRA guidance for Sensitive Personal Information Limits, with practical decisions, evidence, edge cases, and external source citations.

When is a CPRA risk assessment required?

When California businesses must conduct CPRA risk assessments, what each report must contain, and the review, retention, and filing deadlines.

California CCPA and CPRA Applicability Test

Decide whether the CCPA as amended by the CPRA applies, using California nexus, current business thresholds, related-entity rules, and data-specific exemptions.

California CCPA and CPRA Compliance Checklist

A California CCPA/CPRA implementation checklist covering scope, notices, rights, opt-outs, vendor contracts, retention, security, and 2026 regulations.

California CCPA/CPRA Deadlines and Compliance Calendar

Track California CCPA and CPRA request clocks, phased 2026 regulation deadlines, recurring metrics, and separate Delete Act dates.

California CCPA/CPRA Penalties, Fines, and Private Damages

Understand current California CCPA and CPRA fine caps, who enforces them, the limited private action for security breaches, and the evidence to preserve.

California CPRA FAQ

Practical California CPRA FAQ guidance with implementation decisions, evidence, edge cases, and official California source citations.

California CPRA Requirements Guide

California CCPA/CPRA requirements for covered businesses: notices, rights, opt-outs, data-use limits, contracts, security, and phased 2026 rules.

California CPRA Risk Assessments, Cybersecurity Audits, and ADMT Guide

Apply the separate California trigger tests, duties, phase-in dates, evidence, and consumer rights for risk assessments, cybersecurity audits, and ADMT.

California Data Broker Deletion Workflow Guide

California Delete Act and CPRA-adjacent guidance for data broker deletion workflows, with practical decisions, evidence, edge cases, and official citations.

California Data Broker Registry and DROP Guide

California Delete Act guide to data-broker scope, annual registration, DROP processing from August 1, 2026, deletion, opt-out fallback, metrics, and audits.

CCPA vs CPRA: What Changed in California Privacy Law

Compare the original CCPA with the CPRA amendments, including scope thresholds, new rights, contracts, retention, enforcement, and implementation steps.

CPPA Regulations Tracker | CCPA and CPRA

Track the in-force 2023 and 2026 CCPA regulations, their legal status, affected processing, and phased risk, audit, and ADMT deadlines.

CPRA vs Colorado Privacy Act: Practical Comparison

Compare California and Colorado privacy law on scope, consumer rights, opt-outs, sensitive data, contracts, assessments, and enforcement.

CPRA vs Virginia VCDPA: Practical Comparison

Compare California and Virginia privacy law on scope, rights, sale, advertising, sensitive data, contracts, assessments, and enforcement.

US CPRA Compliance Guide

Build a CCPA/CPRA compliance program for scope, notices, consumer rights, opt-outs, vendor contracts, retention, security, and phased 2026 duties.

US CPRA Consumer Rights Workflow Guide

Run California CCPA and CPRA requests to know, delete, correct, opt out, limit, and access or opt out of covered ADMT, with deadlines, verification, exceptions, and evidence.

US CPRA Contract Terms Guide

Required CCPA/CPRA contract terms for service providers, contractors, and third parties, with role tests, clause checks, and evidence.

US CPRA Contracts Contractors and Service Providers Guide

Classify CCPA recipients as service providers, contractors, or third parties and apply the correct purpose limits, contracts, and consumer instructions.

US CPRA Correction Rights Guide

Handle CCPA correction requests: verification, accuracy review, documentation, system and vendor updates, response timing, denials, and records.

US CPRA Cyber Audit Readiness Workflow Guide

Prepare a California cybersecurity audit: calculate section 7120 scope, set the phased audit period, appoint an independent auditor, collect evidence, and submit certification.

US CPRA DSAR and Correction Workflow Guide

US CPRA guidance for DSAR and Correction Workflow, with practical decisions, evidence, edge cases, and external source citations.

US CPRA GPC Handling Guide

How businesses subject to the CCPA must detect, apply, test, and document Global Privacy Control opt-out signals.

US CPRA GPC Handling Workflow Guide

A California GPC workflow for signal detection, browser and profile scope, conflicts, downstream suppression, 15-business-day completion, and test evidence.

US CPRA Retention Guide

How to set, disclose, implement, and review personal-information retention periods under the California CCPA and CPRA.

US CPRA Risk Assessment Intake Workflow Guide

Screen the six CPPA risk-assessment triggers, record exceptions and evidence, hold covered launches for approval, and track review and submission dates.

US CPRA Risk Assessment Template Guide

A California risk-assessment template covering section 7150 triggers, required report fields, contributors, approval, three-year review, material changes, retention, and submission.

US CPRA Risk Assessments and Cybersecurity Audits Guide

Apply the separate CPPA trigger tests for processing-level risk assessments and entity-level annual cybersecurity audits, with phase-in dates and evidence.

US CPRA Sensitive Personal Information Guide

Classify California sensitive personal information, distinguish category status from the right to limit, and apply notices, assessments, controls, and deadlines.

US CPRA Sensitive Personal Information Limits Guide

Decide when California's right to limit applies, map uses to section 7027(m), implement the 15-business-day restriction, and preserve evidence.

US CPRA Sharing and Cross-Context Behavioral Advertising Guide

How to classify advertising data flows as sharing for cross-context behavioral advertising under the California CCPA and CPRA.