California, United States
Amendments to the CCPA
What CPRA changed in California’s privacy law
The California Privacy Rights Act (CPRA) did not create a second privacy law. It amended the CCPA, adding rules on sharing for advertising, sensitive personal information, correction, retention and supplier contracts. This guide explains those changes and the newer regulations built on them.
At a glance
- Who it can apply to
- Businesses covered by the CCPA. The CPRA has no scope test of its own: it amended the CCPA’s thresholds and duties.
- What it is
- Proposition 24, approved by California voters in November 2020. It amended the CCPA from January 1, 2023 and created the California Privacy Protection Agency (CPPA).
- Choices to offer
- Opt-out of sale and of sharing for cross-context behavioral advertising, a right to limit certain uses of sensitive personal information, and a right to correct.
- Website actions
- Treat ad-tech sharing as covered by the opt-out, paid or not.
- Check whether your sensitive data use needs a “Limit” control.
- Disclose how long you keep each category of data.
- Route correction requests to every connected system.
- Align contracts with each recipient’s actual role.
- Primary sources
- Proposition 24 text, CCPA statute, CCPA regulations and CPPA: 2025 regulations
- Last reviewed
How the CPRA relates to the CCPA
The CPRA changed the text of the CCPA rather than adding a parallel law. Today there is one California framework, the CCPA as amended, so do not build separate “CCPA” and “CPRA” consent experiences.
Use the CCPA guide for who is covered, notices, the opt-out link and consumer requests. This page explains what changed and how it affects your website. The key dates:
- November 2020: California voters approved Proposition 24, the CPRA.
- January 1, 2023: the CPRA’s amendments to the CCPA took effect.
- July 1, 2023: civil and administrative enforcement of the amended provisions could begin, for violations on or after that date.
What changed for websites
The table summarizes the changes that most often affect a website; the sections below explain each.
| Change | What it means for your website |
|---|---|
| Sharing for cross-context behavioral advertising | What it means for your websiteAd-tech transfers are covered by the opt-out even when no money changes hands. |
| Right to correct | What it means for your websiteVisitors can ask you to fix inaccurate data, and the fix must reach connected systems. |
| Sensitive personal information and the right to limit | What it means for your websiteIdentify sensitive data. Offer a “Limit” control if you use it beyond permitted purposes. |
| Retention disclosures | What it means for your websiteSay how long you keep each category of data, or how you decide, at or before collection. |
| Contracts with service providers, contractors and third parties | What it means for your websiteWritten terms must limit use to specified purposes and match what each recipient actually does. |
Sharing for cross-context behavioral advertising
Cross-context behavioral advertising means targeting ads using a person’s activity across other businesses’ websites, apps or services. List the tools that receive browsing events, identifiers, purchases or audience data, and check whether the recipient uses them that way.
A “we never sell personal information” statement can mislead if it ignores sharing. Align the statement, the opt-out control and the configuration, and test both browser and server-side routes. A vendor that provides cross-context behavioral advertising is a third party, not a service provider.
Sensitive personal information and the right to limit
Sensitive personal information includes, among other categories, government ID numbers, account log-ins with passwords, precise geolocation, health information and racial or ethnic origin.
The law permits some uses without a right to limit, such as providing the goods or services the consumer asked for. The right to limit applies to uses beyond those. Using account credentials to sign someone in is a permitted use; reusing sensitive data for profiling may not be. If you only use it for permitted purposes and say so in your privacy policy, you do not need the “Limit the Use of My Sensitive Personal Information” link.
Right to correct
A customer may ask you to correct inaccurate personal information, and you must make commercially reasonable efforts to do so. Identify the authoritative record and the systems that copy from it.
Test one request from receipt to completion. If a corrected detail is later overwritten by an old integration, the process still needs work.
Retention and data minimization
At or before collection, tell people how long you intend to keep each category of personal information, or the criteria you use, and keep it no longer than reasonably necessary. Collection and use must also be reasonably necessary and proportionate to the purposes you disclosed.
Avoid a vague “as long as necessary” where a specific period is possible. Compare retention across the website, analytics, customer platform, advertising exports and backups.
Contracts and controls over recipients
Selling or sharing data with a third party, or disclosing it to a service provider or contractor, requires an agreement that limits use to specified purposes, passes on CCPA obligations and lets you act against unauthorized use. A generic confidentiality clause is not enough.
Contracts do not control data flows by themselves. Check that each recipient’s settings and actual use match its contractual role.
Risk assessments, cybersecurity audits and ADMT
The CPRA also asked California’s privacy agency to write rules on risk assessments, cybersecurity audits and automated decisionmaking technology (ADMT). The CPPA Board adopted them on July 24, 2025, the Office of Administrative Law approved them on September 22, 2025, and they took effect on January 1, 2026 (CPPA rulemaking page). The compliance deadlines are phased:
| Requirement | Who it can affect | Deadlines |
|---|---|---|
| Risk assessments | Who it can affectCovered businesses that sell or share personal information, process sensitive data or use ADMT for significant decisions, among others. | DeadlinesBefore new processing from January 1, 2026. Processing started earlier: assess by December 31, 2027, submit by April 1, 2028. |
| Automated decisionmaking technology (ADMT) | Who it can affectBusinesses using ADMT to make significant decisions about consumers. | DeadlinesComply by January 1, 2027. |
| Cybersecurity audits | Who it can affectBusinesses whose processing presents significant security risk under the regulations’ revenue and volume tests. | DeadlinesFirst audit report by April 1, 2028, 2029 or 2030, depending on revenue. |
Note the risk-assessment trigger: a covered business that shares personal information for cross-context behavioral advertising is selling or sharing, so the duty can apply to an ordinary marketing website. Assessments must be updated within 45 days of a material change and reviewed at least every three years.
Cybersecurity audit deadlines depend on annual gross revenue: over $100 million, first report by April 1, 2028; $50–100 million, by April 1, 2029; under $50 million, by April 1, 2030. Screen your activities against these rules, and keep that review separate from banner configuration.
Operational checklist
Review these points whenever you add an advertising integration, a location feature or a personalization tool, even if the banner stays the same.
- Sharing: list every tool that receives browsing or audience data, with its role.
- Opt-out effect: confirm sale and sharing stop in browser and server-side flows.
- Sensitive data: decide whether a “Limit” control is required, and record why.
- Retention: match the periods in your notice to actual settings in each system.
- Correction: follow one request through every connected system.
- Contracts: confirm each recipient’s contract matches its actual use.
- New duties: screen for risk assessments now and for ADMT by January 1, 2027.
FAQ
Does CPRA mean every cookie needs prior consent?
No. California’s rules on sale and sharing remain opt-out for adults. Consent is needed in specific cases, such as selling or sharing the data of consumers known to be under 16, and other jurisdictions may require it.
Is ordinary location information always sensitive?
No. The definition covers precise geolocation: device data used to locate someone within a circle with a radius of 1,850 feet. Check the accuracy and use of the location data you collect.
Can a customer correct information we inferred?
Do not assume inferred information is outside the right. Assess the request, its accuracy and the applicable regulatory rules in context.
Does an opt-out require deleting the account?
No. Sale and sharing opt-outs, deletion and account closure are different actions. Explain and implement each one separately.
Who enforces the CPRA changes?
The California Privacy Protection Agency, created by the CPRA, and the Attorney General both enforce the CCPA as amended.