--- title: "CPRA FAQ" canonical_url: "https://www.sorena.io/artifacts/us/cpra/faq" source_url: "https://www.sorena.io/artifacts/us/cpra/faq" author: "Sorena AI" description: "Answer the California questions that stall CPRA implementation decisions." keywords: - "CPRA FAQ" - "California privacy FAQ" - "CPRA SPI questions" - "CPRA risk assessment FAQ" - "CPRA" - "FAQ" - "California privacy" --- **[SORENA](https://www.sorena.io/)** - AI-Powered GRC Platform [Home](https://www.sorena.io/) | [Solutions](https://www.sorena.io/solutions) | [Artifacts](https://www.sorena.io/artifacts) | [About Us](https://www.sorena.io/about-us) | [Contact](https://www.sorena.io/contact) | [Portal](https://app.sorena.io) --- # CPRA FAQ Answer the California questions that stall CPRA implementation decisions. *FAQ* *CPRA* ## California CPRA FAQ Grounded in the California statute, CPPA regulations, and the 2026 California rule changes. The fastest way to improve a California programme is to answer the recurring edge case questions once and make those answers reusable. ## Scope and SPI questions Common questions include whether the business meets a threshold, whether a use of SPI falls inside the permitted purposes, and whether a limit right notice is required. - Confirm the threshold result with dated finance and volume evidence - Map SPI categories to the specific purpose that justifies each use - Check whether the use falls inside the permitted purpose list before assuming the right to limit does not apply - Record the answer in the notice and control register ## Rights and contract questions Teams also ask when GPC must be treated as a valid signal, how correction differs from access, and whether a vendor truly qualifies as a service provider or contractor. - Process GPC as a valid opt out preference signal in the California workflow - Treat correction as a separate request type with its own verification logic - Use contract purpose limits and due diligence to distinguish service providers, contractors, and third parties - Make sure downstream parties can execute deletion, opt out, and limit instructions ## Assessment and future rule questions Another frequent question is whether the business needs to prepare now for risk assessments, cybersecurity audits, or data broker obligations. - Watch the current California trigger categories for risk assessments - Review revenue size and data practices against the newer audit rules - Check whether the business acts as a California data broker - Use the rule tracker to turn future obligations into planned implementation work *Recommended next step* *Placement: after the FAQ section* ## Use California CPRA FAQ as a cited research workflow Research Copilot can take California CPRA FAQ from cited answers to recurring questions on this topic to a reusable workflow inside Sorena. Teams working on California CPRA can keep owners, evidence, and next steps aligned without copying this guide into separate documents. - [Open Research Copilot for California CPRA FAQ](/solutions/research-copilot.md): Start from California CPRA FAQ and answer scope, timing, and interpretation questions with cited outputs. - [Talk through California CPRA](/contact.md): Review your current process, evidence gaps, and next steps for California CPRA FAQ. ## Primary sources - [CPPA regulations](https://cppa.ca.gov/regulations/?ref=sorena.io) - Official California regulations hub. - [California privacy statute effective January 1, 2026](https://cppa.ca.gov/regulations/pdf/ccpa_statute_2026.pdf?ref=sorena.io) - Current statutory text as reflected in CPPA materials. - [CPPA FAQ](https://cppa.ca.gov/faq.html?ref=sorena.io) - Official California FAQ. - [CPPA CCPA updates](https://cppa.ca.gov/ccpa_updates.html?ref=sorena.io) - Rulemaking and effective date updates. ## Related Topic Guides - [CPPA Regulations Tracker | California Rulemaking Tracker](/artifacts/us/cpra/cppa-regulations-tracker.md): Track the California rules that changed the operating baseline in 2026 and the related regulator outputs. - [CPRA Applicability Test | California Scope and Trigger Guide](/artifacts/us/cpra/applicability-test.md): Confirm California scope and then identify which CPRA specific obligations activate. - [CPRA Checklist | California Privacy Rights Act Checklist](/artifacts/us/cpra/checklist.md): Track the California privacy workstreams that changed under CPRA and the 2026 rules. - [CPRA Compliance Program | California Operating Model](/artifacts/us/cpra/compliance.md): Run a California programme that can absorb ongoing CPPA rules without constant redesign. - [CPRA Consumer Rights Workflow | California Rights Operations](/artifacts/us/cpra/consumer-rights-workflow.md): Run California rights operations across delete, correct, know, opt out, and limit. - [CPRA Contracts, Contractors, and Service Providers](/artifacts/us/cpra/contracts-contractors-and-service-providers.md): Draft California recipient contracts that support both baseline CPRA compliance and the newer assurance obligations. - [CPRA Deadlines and Compliance Calendar | California Privacy Calendar](/artifacts/us/cpra/deadlines-and-compliance-calendar.md): Use the dates that matter for the current California privacy regime. - [CPRA Penalties and Fines | California Enforcement Exposure](/artifacts/us/cpra/penalties-and-fines.md): Understand what makes California exposure larger, faster, and harder to defend. - [CPRA Requirements | California Control Requirements](/artifacts/us/cpra/requirements.md): Translate the current California regime into control statements that teams can build and test. - [CPRA Risk Assessment Template | California Risk Assessment Guide](/artifacts/us/cpra/cpra-risk-assessment-template.md): Use a California specific template that matches the current rule structure instead of a generic DPIA form. - [CPRA Risk Assessments and Cybersecurity Audits | California Assurance Guide](/artifacts/us/cpra/risk-assessments-and-cybersecurity-audits.md): Prepare for the California assurance duties that now have real structure, timing, and evidence requirements. - [CPRA Sensitive Personal Information | California SPI Guide](/artifacts/us/cpra/sensitive-personal-information.md): Handle SPI with the level of design and evidence the California rules now expect. - [CPRA vs CCPA | What Actually Changed in California Privacy](/artifacts/us/cpra/ccpa-vs-cpra.md): A practical CPRA vs CCPA delta guide grounded in the current California statute, CPPA regulations, Proposition 24, and official agency guidance. - [CPRA vs Colorado Privacy Act | State Privacy Comparison](/artifacts/us/cpra/cpra-vs-colorado-privacy-act.md): Compare the California and Colorado models before reusing a state privacy template across both. - [CPRA vs Virginia VCDPA | State Privacy Comparison](/artifacts/us/cpra/cpra-vs-virginia-vcdpa.md): Compare California and Virginia privacy models before reusing contracts or request flows across both. --- [Privacy Policy](https://www.sorena.io/privacy) | [Terms of Use](https://www.sorena.io/terms-of-use) | [DMCA](https://www.sorena.io/dmca) | [About Us](https://www.sorena.io/about-us) (c) 2026 Sorena AB (559573-7338). All rights reserved. Source: https://www.sorena.io/artifacts/us/cpra/faq