🇺🇸California Privacy Rights Act and California Privacy Protection Agency provisions

← Back to laws in United States

CPRA and CPPA provisions: California privacy became more operational

The California Privacy Rights Act strengthened the California privacy framework and created the California Privacy Protection Agency. In practical terms, California privacy compliance is no longer only about having a privacy policy and responding to consumer requests. The implementing regulations make compliance operational: notices must be specific, request methods must be usable, opt-out links must work, preference signals must be respected where applicable, contracts must contain required terms and some businesses must prepare for cybersecurity audits, risk assessments and automated decisionmaking rules.

This page focuses on the California Privacy Protection Agency regulations and the practical compliance architecture they require.

Required disclosures are central

The regulations require businesses subject to the CCPA to provide a privacy policy, notice at collection and, where relevant, notices for opt-out of sale or sharing, limitation of sensitive personal information, financial incentives and automated decisionmaking technology. The privacy policy must give consumers a comprehensive description of online and offline information practices and explain the rights available to them.

The notice at collection is especially important because it must be given at or before collection. It should match the actual categories of personal information, purposes, retention periods and sale or sharing practices of the business.

Consumer choice must be easy and symmetrical

The regulations focus heavily on user interface design. Methods for submitting requests and giving consent must be easy to understand and must not subvert or impair consumer choice. A process that makes opting out harder than opting in, hides the decline option, uses confusing double negatives or makes the “yes” option more prominent can create compliance risk.

This is important for cookie banners, app settings, financial incentive enrolment, privacy dashboards and consent prompts. The privacy choice should be a real choice, not a design trick.

Opt-out links and preference signals

Businesses that sell or share personal information generally need to provide a “Do Not Sell or Share My Personal Information” mechanism unless an applicable alternative route is used. Businesses that use or disclose sensitive personal information beyond specified purposes generally need a “Limit the Use of My Sensitive Personal Information” mechanism. The regulations also allow a combined alternative opt-out link such as “Your Privacy Choices” or “Your California Privacy Choices” where the requirements are met.

Opt-out preference signals are a major operational issue. If a business receives a valid signal that communicates the consumer’s choice, internal systems, advertising tools and downstream disclosures must be configured to respond appropriately.

Service providers, contractors and third parties

The regulations distinguish between service providers, contractors and third parties. A business should not assume that every vendor is automatically a service provider. The written contract must restrict use, disclosure and retention of personal information and must align with the vendor’s role. Where data is disclosed to a third party rather than a service provider or contractor, sale or sharing analysis may become necessary.

Vendor classification should therefore be part of the data inventory. Each disclosure should identify the recipient, purpose, contract type, permitted uses, whether the recipient can combine data, and whether the disclosure is a sale, sharing or service provider activity.

Audits, risk assessments and automated decisionmaking

The CPPA regulations add a forward-looking governance layer. Cybersecurity audits, risk assessments and automated decisionmaking technology provisions require businesses to examine higher-risk processing before or during use, document risks and safeguards, and provide consumer-facing notices and rights where required.

For organisations using profiling, AI systems, adtech optimisation, eligibility screening, fraud models or other automated decision tools, these rules should be built into product review and vendor onboarding rather than handled as a last-minute legal sign-off.