--- title: "CPRA enforcement advisories: CPPA investigations, fines, and risk mitigation" canonical_url: "https://www.sorena.io/artifacts/us/california-privacy-rights-act/faq/enforcement-advisories" source_url: "https://www.sorena.io/artifacts/us/california-privacy-rights-act/faq/enforcement-advisories" author: "Sorena AI" description: "US CPRA guidance for Enforcement Advisories, with practical decisions, evidence, edge cases, and external source citations." published_at: "2026-05-09" updated_at: "2026-05-09" keywords: - "US CPRA" - "Enforcement Advisories" - "US CPRA Enforcement Advisories" - "compliance checklist" - "practical guidance" - "Compliance" - "Regulatory guidance" --- **[SORENA](https://www.sorena.io/)** - AI-Powered GRC Platform [Home](https://www.sorena.io/) | [Solutions](https://www.sorena.io/solutions) | [Artifacts](https://www.sorena.io/artifacts) | [About Us](https://www.sorena.io/about-us) | [Contact](https://www.sorena.io/contact) | [Portal](https://app.sorena.io) --- # CPRA enforcement advisories: CPPA investigations, fines, and risk mitigation US CPRA guidance for Enforcement Advisories, with practical decisions, evidence, edge cases, and external source citations. *Artifact Guide* *US* *Enforcement Advisories* ## US CPRA Enforcement Advisories Enforcement Advisories decisions under the US CPRA should be written in operational language: who is in scope, what must happen, what evidence proves it, and when escalation is needed. This page offers practical steps for implementation planning. Confirm legal and policy assumptions before implementation. Enforcement Advisories are CPPA enforcement guidance documents that flag how the agency is applying parts of the CCPA, as amended by the CPRA. This page explains what they are and gives teams a practical way to turn them into owners, evidence, and next steps. ## What enforcement and penalty risks should teams plan for under the US CPRA? Enforcement Advisories are CPPA guidance documents that address select provisions of the California Consumer Privacy Act and its implementing regulations. They are meant to help regulated businesses understand where the Enforcement Division sees risk and how it is thinking about compliance in practice. Teams should treat Enforcement Advisories under the US CPRA as a source-linked operating decision: confirm whether the issue affects threshold status, sensitive personal information, sharing or cross-context advertising, GPC, correction rights, data-broker duties, ADMT, risk assessments, cybersecurity audits, or service-provider contracts, assign the team that can change the process, and keep evidence showing the action and review trigger. The safest first step is to identify the data category, consumer-facing interaction, sale/share status, sensitive-personal-information issue, and vendor role before assigning the CPRA action. - Write the Enforcement Advisories decision in one sentence before drafting controls. - Attach the external source URL and a short source quote to the evidence record. - Route unclear cases to legal, privacy, security, or compliance review before launch. Sources for this answer: - [California Privacy Protection Agency Announces 2025 Increases for CCPA Fines and Penalties](https://cppa.ca.gov/announcements/2024/20241217.html?ref=sorena.io) - Official CPPA source for current administrative fine and civil-penalty amounts that drive CPRA enforcement-risk planning. - [CPPA Enforcement Division Issues First Advisory](https://cppa.ca.gov/announcements/2024/20240402.html?ref=sorena.io) - Official CPPA source explaining that enforcement advisories share observations with regulated businesses and encourage CCPA compliance. - [California Privacy Protection Agency FAQ](https://cppa.ca.gov/faq.html?ref=sorena.io) - Direct support for the FAQ answer on Enforcement Advisories. ## What evidence should teams keep for Enforcement Advisories under the US CPRA? Useful evidence is not just a privacy policy. Keep the source, threshold notes, request logs, GPC test evidence, notice screenshots, vendor terms, retention logic, and approval trail together. - Source URL and quote used for the decision. - Scope notes, screenshots, data-flow or system references, and role mapping. - Implementation ticket, approval record, exception notes, and review date. Sources for this answer: - [CPPA Enforcement Division Issues First Advisory](https://cppa.ca.gov/announcements/2024/20240402.html?ref=sorena.io) - Official CPPA source explaining that enforcement advisories share observations with regulated businesses and encourage CCPA compliance. - [California Privacy Protection Agency FAQ](https://cppa.ca.gov/faq.html?ref=sorena.io) - Evidence support for the FAQ answer. - [California legislative bill text](https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202320240SB362&ref=sorena.io) - Evidence support for the FAQ answer. ## Which mistakes create risk when handling Enforcement Advisories under the US CPRA? The common failure pattern is treating every California privacy issue as a generic CCPA notice update instead of checking CPRA amendments, sharing, sensitive data, GPC, and phased CPPA rulemaking. - Using an old threshold, deadline, source page, or contract template without checking current source text. - Treating a source-linked exception as a general exemption for every product or data flow. - Publishing notices, controls, or answers that do not match the actual product behavior. Sources for this answer: - [California Privacy Protection Agency Announces 2025 Increases for CCPA Fines and Penalties](https://cppa.ca.gov/announcements/2024/20241217.html?ref=sorena.io) - Official CPPA source for current administrative fine and civil-penalty amounts that drive CPRA enforcement-risk planning. - [CPPA Enforcement Division Issues First Advisory](https://cppa.ca.gov/announcements/2024/20240402.html?ref=sorena.io) - Official CPPA source explaining that enforcement advisories share observations with regulated businesses and encourage CCPA compliance. - [California Privacy Protection Agency FAQ](https://cppa.ca.gov/faq.html?ref=sorena.io) - Risk and boundary support for the FAQ answer. - [California legislative bill text](https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202320240SB362&ref=sorena.io) - Risk and boundary support for the FAQ answer. ## Primary sources - [California Privacy Protection Agency Announces 2025 Increases for CCPA Fines and Penalties](https://cppa.ca.gov/announcements/2024/20241217.html?ref=sorena.io) - Official CPPA source for current administrative fine and civil-penalty amounts that drive CPRA enforcement-risk planning. - Quote: "Civil penalty amounts Not more than $2,663 for each violation or $7,988 for each intentional violation" - [CPPA Enforcement Division Issues First Advisory](https://cppa.ca.gov/announcements/2024/20240402.html?ref=sorena.io) - Official CPPA source explaining that enforcement advisories share observations with regulated businesses and encourage CCPA compliance. - Quote: "Enforcement Advisories share observations with the regulated community to further compliance with the California Consumer Privacy Act" - [California Privacy Protection Agency FAQ](https://cppa.ca.gov/faq.html?ref=sorena.io) - Supports Enforcement Advisories under the US CPRA. - Quote: "The CPRA amended the CCPA by adding additional consumer privacy rights and obligations for businesses" - [California legislative bill text](https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202320240SB362&ref=sorena.io) - Supports Enforcement Advisories under the US CPRA. - Quote: "(ii) Does not make use of any dark patterns" - [Privacy Framework](https://www.nist.gov/privacy-framework/resource-repository/browse/crosswalks?ref=sorena.io) - Supports Enforcement Advisories under the US CPRA. - Quote: "Organizations should not assume implementation of these Privacy Framework activities or outcomes means that they have met the" ## Topic Guides - [California CPRA Checklist](/artifacts/us/california-privacy-rights-act/checklist.md): Practical guidance for the California CPRA checklist, with practical decisions, evidence, edge cases, and external source citations. - [California CPRA FAQ](/artifacts/us/california-privacy-rights-act/faq.md): Practical California CPRA FAQ guidance with implementation decisions, evidence, edge cases, and official California source citations. - [California CPRA penalties and fines Guide](/artifacts/us/california-privacy-rights-act/penalties-and-fines.md): US CPRA guidance for penalties and fines, with practical decisions, evidence, edge cases, and external source citations. - [California CPRA Requirements Guide](/artifacts/us/california-privacy-rights-act/requirements.md): Practical guidance for California CPRA requirements, with practical decisions, evidence, edge cases, and external source citations. - [California CPRA Risk Assessments, Cybersecurity Audits, and ADMT Guide](/artifacts/us/california-privacy-rights-act/risk-assessments-cybersecurity-audits-and-admt.md): California CPRA guidance for risk assessments, cybersecurity audits, and ADMT, with practical decisions, evidence, edge cases, and external source citations. - [California Data Broker Deletion Workflow Guide](/artifacts/us/california-privacy-rights-act/data-broker-deletion-workflow.md): California Delete Act and CPRA-adjacent guidance for data broker deletion workflows, with practical decisions, evidence, edge cases, and official citations. - [California Data Broker Registry and DROP Guide](/artifacts/us/california-privacy-rights-act/data-broker-registry-and-drop.md): California Delete Act guide to the Data Broker Registry and DROP, with practical decisions, evidence, edge cases, and official source citations. - [California Delete Act data broker registry and DROP guide](/artifacts/us/california-privacy-rights-act/faq/data-broker-registry-and-drop.md): California Delete Act guidance for the data broker registry and Delete Request and Opt-Out Platform (DROP), with owners, evidence, and official sources. - [CPRA Global Privacy Control (GPC): opt-out requirements and enforcement FAQ](/artifacts/us/california-privacy-rights-act/faq/gpc.md): US CPRA guidance for GPC, with practical decisions, evidence, edge cases, and external source citations. - [US CPRA Applicability Test Guide](/artifacts/us/california-privacy-rights-act/applicability-test.md): Practical guidance for the US CPRA applicability test, with practical decisions, evidence, edge cases, and external source citations. - [US CPRA CCPA vs CPRA Guide](/artifacts/us/california-privacy-rights-act/ccpa-vs-cpra.md): US CPRA guidance for CCPA vs CPRA, with practical decisions, evidence, edge cases, and external source citations. - [US CPRA Compliance Guide](/artifacts/us/california-privacy-rights-act/compliance.md): Practical guidance for the US CPRA compliance, with practical decisions, evidence, edge cases, and external source citations. - [US CPRA Consumer Rights Workflow Guide](/artifacts/us/california-privacy-rights-act/consumer-rights-workflow.md): US CPRA guidance for Consumer Rights Workflow, with practical decisions, evidence, edge cases, and external source citations. - [US CPRA Contract Terms Guide](/artifacts/us/california-privacy-rights-act/contract-terms.md): US CPRA guidance for Contract Terms, with practical decisions, evidence, edge cases, and external source citations. - [US CPRA Contracts Contractors And Service Providers Guide](/artifacts/us/california-privacy-rights-act/contracts-contractors-and-service-providers.md): US CPRA guidance for Contracts Contractors And Service Providers, with practical decisions, evidence, edge cases, and external source citations. - [US CPRA Correction Rights Guide](/artifacts/us/california-privacy-rights-act/correction-rights.md): US CPRA guidance for Correction Rights, with practical decisions, evidence, edge cases, and external source citations. - [US CPRA Cppa Regulations Tracker Guide](/artifacts/us/california-privacy-rights-act/cppa-regulations-tracker.md): US CPRA guidance for Cppa Regulations Tracker, with practical decisions, evidence, edge cases, and external source citations. - [US CPRA Cyber Audit Readiness Workflow Guide](/artifacts/us/california-privacy-rights-act/cyber-audit-readiness-workflow.md): US CPRA guidance for Cyber Audit Readiness Workflow, with practical decisions, evidence, edge cases, and external source citations. - [US CPRA Deadlines and Compliance Calendar Guide](/artifacts/us/california-privacy-rights-act/deadlines-and-compliance-calendar.md): US CPRA guidance for Deadlines and Compliance Calendar, with practical decisions, evidence, edge cases, and external source citations. - [US CPRA DSAR And Correction Workflow Guide](/artifacts/us/california-privacy-rights-act/dsar-and-correction-workflow.md): US CPRA guidance for DSAR And Correction Workflow, with practical decisions, evidence, edge cases, and external source citations. - [US CPRA GPC Handling Guide](/artifacts/us/california-privacy-rights-act/gpc-handling.md): US CPRA guidance for GPC Handling, with practical decisions, evidence, edge cases, and external source citations. - [US CPRA GPC Handling Workflow Guide](/artifacts/us/california-privacy-rights-act/gpc-handling-workflow.md): US CPRA guidance for GPC Handling Workflow, with practical decisions, evidence, edge cases, and external source citations. - [US CPRA Retention Guide](/artifacts/us/california-privacy-rights-act/retention.md): US CPRA guidance for Retention, with practical decisions, evidence, edge cases, and external source citations. - [US CPRA Risk Assessment Intake Workflow Guide](/artifacts/us/california-privacy-rights-act/risk-assessment-intake-workflow.md): US CPRA guidance for Risk Assessment Intake Workflow, with practical decisions, evidence, edge cases, and external source citations. - [US CPRA Risk Assessment Template Guide](/artifacts/us/california-privacy-rights-act/cpra-risk-assessment-template.md): US CPRA guidance for CPRA Risk Assessment Template, with practical decisions, evidence, edge cases, and external source citations. - [US CPRA Risk Assessments And Cybersecurity Audits Guide](/artifacts/us/california-privacy-rights-act/risk-assessments-and-cybersecurity-audits.md): US CPRA guidance for Risk Assessments And Cybersecurity Audits, with practical decisions, evidence, edge cases, and external source citations. - [US CPRA Sensitive Personal Information Guide](/artifacts/us/california-privacy-rights-act/sensitive-personal-information.md): US CPRA guidance for Sensitive Personal Information, with practical decisions, evidence, edge cases, and external source citations. - [US CPRA Sensitive Personal Information Limits Guide](/artifacts/us/california-privacy-rights-act/sensitive-personal-information-limits.md): US CPRA guidance for Sensitive Personal Information Limits, with practical decisions, evidence, edge cases, and external source citations. - [US CPRA Sharing and Cross-Context Behavioral Advertising Guide](/artifacts/us/california-privacy-rights-act/sharing-and-cross-context-behavioral-advertising.md): US CPRA guidance for Sharing and Cross-Context Behavioral Advertising, with practical decisions, evidence, edge cases, and external source citations. - [US CPRA vs Colorado Privacy Act Guide](/artifacts/us/california-privacy-rights-act/cpra-vs-colorado-privacy-act.md): US CPRA guidance for CPRA vs Colorado Privacy Act, with practical decisions, evidence, edge cases, and external source citations. - [US CPRA vs Virginia Vcdpa Guide](/artifacts/us/california-privacy-rights-act/cpra-vs-virginia-vcdpa.md): US CPRA guidance for CPRA vs Virginia Vcdpa, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about ADMT under the US CPRA?](/artifacts/us/california-privacy-rights-act/faq/admt.md): US CPRA guidance for ADMT, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about Contract Terms under the US CPRA?](/artifacts/us/california-privacy-rights-act/faq/contract-terms.md): US CPRA guidance for Contract Terms, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about Correction Rights under the US CPRA?](/artifacts/us/california-privacy-rights-act/faq/correction-rights.md): US CPRA guidance for Correction Rights, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about Cybersecurity Audits under the US CPRA?](/artifacts/us/california-privacy-rights-act/faq/cybersecurity-audits.md): US CPRA guidance for Cybersecurity Audits, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about retention under the California CPRA?](/artifacts/us/california-privacy-rights-act/faq/retention.md): California CPRA guidance for retention, including data minimization, privacy policy disclosures, evidence records, and official source citations. - [What should teams do about Risk Assessments under the US CPRA?](/artifacts/us/california-privacy-rights-act/faq/risk-assessments.md): US CPRA guidance for Risk Assessments, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about Sensitive Personal Information Limits under the US CPRA?](/artifacts/us/california-privacy-rights-act/faq/sensitive-personal-information-limits.md): US CPRA guidance for Sensitive Personal Information Limits, with practical decisions, evidence, edge cases, and external source citations. - [What should teams do about Sharing and Cross-Context Behavioral Advertising under the California CPRA?](/artifacts/us/california-privacy-rights-act/faq/sharing-and-cross-context-behavioral-advertising.md): California CPRA guidance for Sharing and Cross-Context Behavioral Advertising, with practical decisions, evidence, edge cases, and external source citations. *Recommended next step* *Placement: after the practical guidance* ## Turn US CPRA Enforcement Advisories into assigned work This US CPRA guide turns turn Enforcement Advisories into owners, evidence requests, review checkpoints, and reusable operating records inside Sorena. - [Open Assessment Autopilot for US CPRA](/solutions/assessment.md): Turn Enforcement Advisories into scoped questions, evidence fields, and review tasks. - [Review US CPRA source evidence](/solutions/research-copilot.md): Use Research Copilot to answer follow-up questions with cited source material. - [Talk through implementation](/contact.md): Review scope, evidence, owners, and the next compliance actions with Sorena. --- [Privacy Policy](https://www.sorena.io/privacy) | [Terms of Use](https://www.sorena.io/terms-of-use) | [DMCA](https://www.sorena.io/dmca) | [About Us](https://www.sorena.io/about-us) (c) 2026 Sorena AB (559573-7338). All rights reserved. Source: https://www.sorena.io/artifacts/us/california-privacy-rights-act/faq/enforcement-advisories