For the broader framework across regions, start with our Global Privacy Law Hub.
Section 1: What Is CCPA/CPRA and How It Differs from GDPR
The CCPA Foundation (2020–Present)
The California Consumer Privacy Act (CCPA) was the first comprehensive state privacy law in the United States. It grants California residents new rights over their personal information and requires businesses to be transparent about data collection and use.
Key baseline features:
- Effective Date: January 1, 2020
- Enforcement began: July 1, 2020 (after initial grace period)
- Model: Opt-out (users can request that businesses stop selling their data)
- Scope: Personal information collected from California residents
The CPRA Evolution (2023–Present)
The California Privacy Rights Act (CPRA) was passed in 2020 as a ballot proposition and significantly expanded CCPA protections. It introduced:
- Effective Date: January 1, 2023
- Enforcement: Now handled by the new California Privacy Protection Agency (CPPA), in addition to the Attorney General
- New rights: Correction, deletion, opt-out of targeted advertising, profiling, biometric data protections
- Stricter penalties: Up to $7,500 per intentional violation (vs. $2,500 per violation under CCPA)
- Scope: Broader definition of “personal information” and “consumer”
Opt-Out vs. Opt-In: The Critical Difference from GDPR
This is where California’s approach diverges sharply from GDPR. Under CCPA/CPRA, you don’t need affirmative consent to collect data—you need to provide a mechanism (usually a “Do Not Sell My Personal Information” link/button) for users to opt-out. This is fundamentally different from GDPR, where the burden is on the business to get permission first.
Section 2: Who CCPA/CPRA Applies To
Scope of Business Coverage
CCPA/CPRA applies to any for-profit entity that:
- Operates in California (physical presence, conducts business, or serves California residents), AND
- Meets at least one of these thresholds:
- Gross annual revenues: $25+ million (in any fiscal year)
- Buys/receives/shares personal information of 100,000+ California residents or households (in a single calendar year)
- Derives 50%+ of annual revenue from selling/sharing California residents’ personal information
Key Point: You Don’t Need to Be Based in California
The law applies to businesses anywhere in the world that serve California residents. If your website is accessible to Californians and they make purchases or provide information, you’re likely in scope.
Section 3: Core Consent and Disclosure Requirements
The “Do Not Sell My Personal Information” Button
Under CCPA, you must display a clear, conspicuous link or button labeled “Do Not Sell My Personal Information” or “Do Not Sell or Share My Personal Information” (CPRA version) on the homepage and in the footer.
Requirements:
- Placement: Easily findable (homepage footer, top-right corner, or similar prominent location)
- Label: Must match the statutory language (or “Do Not Sell or Share” under CPRA)
- Functionality: Must lead to a mechanism where users can submit opt-out requests
- Mobile: Must be equally accessible on mobile devices
- Response Time: Requests must be processed within 45 days (30 days under CPRA)
Consumer Rights You Must Honor
1. Right to Access – Consumers can request what personal information you’ve collected about them and must receive a portable copy within 45 days (30 under CPRA).
2. Right to Delete – Consumers can request deletion of personal information, which you must complete within 45 days (30 under CPRA), unless you have a legal right to retain it.
3. Right to Opt-Out of Sale/Sharing – CCPA requires “Do Not Sell My Personal Information”; CPRA also covers “Do Not Share My Personal Information” (targeted advertising, profiling).
4. Right to Correct (CPRA Only) – Consumers can request correction of inaccurate personal information within 45 days, unless correction would violate law.
5. Right to Opt-Out of Profiling (CPRA Only) – Consumers can opt-out of profiling with “a legal or similarly significant effect,” covering automated decision-making that affects privacy or civil rights.
Section 4: What You Must NOT Do—Dark Patterns
California regulators are particularly vigilant about dark patterns—interface designs that trick users into giving up privacy rights. Key banned practices:
1. Hiding the Opt-Out – ❌ Burying “Do Not Sell” in a long privacy policy or making it smaller/different color. ✅ Prominent link with same visual treatment.
2. Deceptive Language – ❌ “Allow personalization” when you mean “allow sale of data.” ✅ Clear, honest description of data sharing.
3. False Urgency – ❌ “Opt out now or miss deals” (threat). ✅ Single-click, straightforward opt-out.
Section 5: Real Penalties and Enforcement Trends
The Cost of Non-Compliance
CCPA Penalties (2020–2022): Up to $2,500 per violation; $7,500 per intentional violation.
CPRA Penalties (2023–Present): Up to $7,500 per intentional violation (tripled); $100–$750 per consumer per incident for data breaches; dedicated California Privacy Protection Agency with enforcement budget.
Recent Enforcement Examples
- Meta/Facebook (2021): $100 million settlement for CCPA violations
- Amazon (2023): FTC action citing deceptive dark patterns in consent
- Google (2024): Multiple state AGs investigating consent mechanisms for location tracking
- TikTok (2024): CPPA investigating data practices and consumer rights mechanisms
Section 6: Why Compliance Matters Now
The California Privacy Protection Agency is ramping up enforcement, and multiple states are adopting similar laws (Colorado, Virginia, Texas, Utah, Connecticut, Montana, Delaware). If you’re compliant with CPRA, you’re 80% compliant with other state laws.
Section 7: 7-Step Compliance Audit Checklist
Step 1: Data Inventory
- List all personal information collected
- Document how and when you collect it
- Identify why you collect each category
- Record who receives the data (third parties)
Step 2: Privacy Policy Review
- Clearly disclose categories of personal information
- Explain the purpose for each collection
- List all recipients (third parties)
- Describe retention periods
- Explain consumer rights (access, delete, opt-out, correct, opt-out of profiling)
- Use clear, non-technical language
Step 3: “Do Not Sell” Button Implementation
- Place prominently on homepage (footer, header, or top-right)
- Use accurate statutory language
- Link to functioning opt-out mechanism
- Test on desktop and mobile
- Provide secondary method (email, phone)
Step 4: Opt-Out Mechanism Functionality
- Request email/phone verification without excessive friction
- Confirm receipt of request
- Process opt-outs within 45 days (30 under CPRA)
- Have internal process to honor opt-out requests
- Allow users to easily opt back in
Step 5: Consumer Rights Fulfillment
- Enable data access requests (45/30-day response)
- Enable deletion requests (45/30-day response)
- Enable correction requests (CPRA)
- Enable data portability (CPRA)
- Verify identity without excessive friction
- Document all decisions to deny requests
Step 6: Data Security and Breach Response
- Implement reasonable security (encryption, access controls)
- Have breach notification process
- Notify affected consumers and CPPA for CPRA breaches
- Document all breach notifications
Step 7: Third-Party Compliance
- Ensure contracts with vendors restrict data use
- Verify third parties don’t resell California resident data
- Include CCPA/CPRA clauses in service agreements
- Audit contracts annually
FAQ: Common CCPA/CPRA Questions
Q: Do I have to delete data even if it affects service?
A: No, not unconditionally. You can retain data necessary to complete transactions, provide requested services, comply with legal obligations, detect security incidents, or debug errors. But you can’t use “we need it for analytics” or “future marketing” as excuses. Honor deletion requests for non-essential data only.
Q: Can I use the same consent banner for GDPR and CCPA?
A: No. CCPA/CPRA is opt-out; GDPR is opt-in. A GDPR-style banner may exceed CCPA requirements but will confuse users. Best practice: use separate mechanisms or a smart banner that detects location.
Q: What’s the difference between “Selling” and “Sharing” data?
A: Selling means monetary transactions. Sharing (CPRA) means allowing third-party access for targeted advertising/profiling without payment. CPRA closed the loophole where businesses didn’t technically “sell” but shared with ad networks. If you use Google Analytics or Facebook Pixel for targeting, you need “Do Not Share” mechanisms.
Q: What if I ignore CCPA/CPRA?
A: Potential consequences include civil penalties ($2,500–$7,500 per violation), data breach lawsuits ($100–$750 per consumer), regulatory investigations, cease-and-desist orders, and class action exposure. Compliance is cheaper than litigation.
Conclusion: Your CCPA/CPRA Compliance Roadmap
CCPA and CPRA represent a fundamental shift in privacy rights. The key takeaway: Compliance is not optional, and it’s not complex.
Six steps to compliance:
- Map your data: Know what you collect, why, and who receives it
- Update your privacy policy: Be transparent about data use
- Add opt-out mechanisms: Provide “Do Not Sell My Personal Information” link
- Build consumer rights workflows: Enable access, deletion, correction requests
- Audit for dark patterns: Ensure consent mechanisms are clear and honest
- Plan for multi-state: CPRA is the template; other states are following
Starting now—even with incremental improvements—puts you ahead of the curve and protects your business from regulatory action. The California Privacy Protection Agency is ramping up enforcement, and penalties are accelerating.
Ready to get compliant? Use the 7-step audit checklist above, or reach out to a privacy consultant for final review.
Authoritative Sources & Further Reading
- California Attorney General Privacy Page: https://oag.ca.gov/privacy
- California Privacy Protection Agency (CPPA): https://cppa.ca.gov
- CCPA Official Text: California Civil Code § 1798.100 et seq.
- CPRA Official Text: Proposition 24 (effective Jan 1, 2023)
- CPRA Regulations (Proposed): https://cppa.ca.gov/rulemaking/
- California Attorney General CCPA Enforcement Actions: https://oag.ca.gov/privacy/ccpa/enforcement
About The Author
