The Complete Guide to CPRA Compliance

A consumer is any individual in California for non-temporary and non-transitory reasons, including California residents traveling outside the state who plan to return.

• Gross annual revenue of at least $25 million
• Buys, sells, or shares the personal data of at least 100,000 consumers
• Makes at least half of its revenue from selling data

A business must inform consumers that they use and sell personal data, and provide an easily accessible link that will allow consumers to opt-out.

A business must inform consumers that they use and sell personal data, and provide an easily accessible link that will allow consumers to opt-out.

Keep in mind that personal information does not include information that's been “de-identified.” De-identified information has been stripped of identifying aspects so that businesses can use it safely. To count as de-identified information, the data cannot be re-identified later and businesses must have prevention procedures in place.

• Driver’s license, social security, or passport numbers
• Log-in information for financial accounts
• Credit and debit card numbers
• Geolocation data
• Data on a consumer’s religion, ethnicity, or race
• A consumer's mail, email, or texts
• Biometric and genetic data
• Data about a consumer's sexual orientation or health

Processing refers to the collection, possession, or handling of consumer data, both manual and automated. Collecting data through a form and tracking cookies are two common forms of data processing.

Businesses must delete a consumer's data upon request, as long as the consumer's identity can be verified. In addition, the business must direct any vendors and other service providers to do the same.

Consumer have the right to ask a business to correct inaccuracies in the personal data they currently hold. If the business receives a consumer request for correction, they are required to exert "reasonable" effort to correct that data.

Consumers have the right to request access to any personal data a business has collected.

Customers have the right to know what data and categories of data a business is collecting on them. They also have the right to know how that data is being collected and how it’s being used by both the business and any third parties.



If a business sells or shares personal information, consumers may request to know what categories of data are being collected, the categories of personal data being sold or shared with a third party, and the categories of data a business has disclosed.

At any time, a consumer has the right to tell a business that sells their personal information not to do so.

Businesses must honor a consumer's request to limit the use or disclosure of their personal information, unless the consumer provides consent at a later date.

• Biometrics
• Health records
• Sex life details
• Sexual orientation

• Social Security numbers
• Driver’s license numbers
• State ID card numbers
• Passport numbers
• Account logins and passwords
• Precise geolocation
• Racial and ethnic origins
• Religious and philosophical beliefs
• Union membership status
• Contents of mail, email, and text not sent to the business
• Genetic data
• Biometrics
• Health records
• Sex life details
• Sexual orientation

Before CPRA, a business processing data for 50,000 or more consumers fell under the CCPA's scope. The CPRA doubled this number—increasing the threshold to 100,000 consumers.



This means that, under the CPRA, many smaller CA businesses may end up being exempt. However, there are other scope criteria so make sure those are considered.

Under the CCPA, businesses automatically had 30 days to address or "cure" a violation after receiving notice. The CPRA made the cure period discretionary, meaning it will only be provided on a case-by-case basis by the California Privacy Protection Agency.

Understanding what data you collect and hold, as well as how it's being used is a critical part of CPRA (or any privacy law) compliance.



This process, often called data mapping, will help your organization fulfill consumer requests for access or deletion, identify risky data processing, and track down affected data in the event of a breach.



Though data mapping isn't required by the CPRA it's key to fulfilling many of the obligations the CPRA places on businesses.

Responding to consumer requests for data access, correction, or deletion sounds relatively simple, at first. But fulfilling privacy requests means first knowing where to find the relevant data (part of why an up-to-date data map is so important), and then collating, packaging, and transmitting the data you find.



Without the right privacy infrastructure, this process quickly starts to eat at your team's time. More than that, manual request fulfillment opens opportunity for human error and security vulnerabilities.



Even if you don't take the path of an automated privacy software, it's best to define the data request fulfillment process before requests start pouring in—smoothing inefficiencies where possible and automating what you can.

One key part of data request fulfillment, one that deserves it's own call-out, is identity verification.



Imagine responding to a data request i.e. sending an enormous data file containing a consumer's personal information (which can include credit card info, a social security number, or even sensitive health data)—only to realize after the fact the data was sent to the wrong person. 



Whether a simple accident or the result of a scam, this scenario is a big risk for any privacy program. Implementing an identify verification system like two-factor authentication is critical to ensuring request validity and personal data security (which, if you remember, is an explicit CPRA requirement). 



Organizations are both allowed and expected to verify a consumer's identify before fulfilling a request, so setting up a system to support this process is key. 



Though an automated identity verification system isn't required, it can ease the burden on both your organization and the consumer—and is baked in to many privacy request fulfillment platforms. 

Transparency around data processing is an important part of CPRA compliance, so it's important to refresh your organization's privacy policy on, at minimum, an annual basis.



A compliant privacy policy will provide up-to-date information about how your organization collects, stores, shares, and uses consumer data, including:

The CPRA requires that companies allow consumers to opt-out of the sale of their personal data. This means companies under the CPRA must provide a clear and conspicuous "Do not sell or share my personal information" link on their homepage. Most companies choose to put this link in the footer menu. 



We should note too that, under the CPRA, the law was expanded to include data sharing—meaning that if consumer data changes hands for the purpose of targeted advertising, even if no money is exchanged, the consumer must be given the option to say no.



In practical terms, this means that once the CPRA goes into affect on Jan 1, 2023, these links must be updated to reflect opt-out of data sharing. 

The majority of CCPA requirements follow an opt-out consent regime, meaning organizations can process data without consent but must provide an option to opt-out at any point. However, the rules for minors age 13 to 16 are different.



Minors under the CPRA are protected by an opt-in consent regime, meaning organizations must obatin consent before selling or sharing personal information. Minors between 13 and 16 may opt-in on their own behalf, while for minors under 13 opt-in must come from a parent or legal guardian.



Minors that opt-in must also have the option to opt-out if they change their mind after the fact.