CPRA: The California privacy changes that reach beyond your banner

Who should use this guide?

This guide is relevant if your business is covered by the CCPA as amended. The California Privacy Protection Agency’s FAQ explains the current applicability tests.

Use the CCPA guide to review the basic website journey and scope. Use this guide to examine the additions associated with CPRA: sharing for behavioural advertising, correction, sensitive personal information, retention and stronger operational controls.

Do not create separate “CCPA consent” and “CPRA consent” experiences. Customers need one coherent set of applicable California privacy choices.

What changed for website owners?

The amended framework expressly addresses sharing for cross-context behavioural advertising. That makes it important to assess advertising transfers even when nobody pays directly for the information.

It also gives consumers a right to correction and, in specified circumstances, to limit uses and disclosures of sensitive personal information. Businesses need to consider purpose limitations, retention and their relationships with service providers, contractors and third parties.

The current CCPA statute and regulations are the reference point. “We installed a banner several years ago” is not evidence that these continuing obligations are covered.

Five things to get right

1. Review advertising sharing separately from sales

List the tools that receive browsing events, identifiers, purchase information or audience data. Determine whether the recipient uses them for cross-context behavioural advertising or another regulated purpose.

A “we never sell personal information” statement can be misleading if it ignores legally relevant sharing. Align the statement, the opt-out link and the actual configuration.

Test the outcome across browser and server-side connections. If an opted-out visitor’s data still reaches a partner for the restricted purpose through another route, the visual control has not solved the problem.

2. Identify sensitive information and its uses

Sensitive personal information includes specified categories such as precise geolocation and certain information about health, identity or account access. Context and use matter.

The right to limit is not a blanket rule that every use of every sensitive item needs the same consent popup. Assess whether your uses go beyond the permitted purposes that are exempt from the limitation requirement.

For example, a customer may provide account credentials to sign in. Reusing sensitive information for unrelated profiling raises a different question. Collect only what the service reasonably needs and make relevant controls available where required.

3. Put retention into the working setup

For each category of information, decide how long it is needed or the criteria used to decide. Reflect applicable retention disclosures in your notices, and ensure operational settings support the decision.

Avoid one vague “we keep data as long as necessary” statement where a more specific explanation is required. Equally, do not promise immediate deletion while keeping unrestricted copies in advertising exports or old systems.

A useful starting point is to compare retention across the website, analytics tools, customer platform and backups. Document justified differences and remove data that has no continuing purpose.

4. Make correction and downstream requests practical

A customer may ask you to correct inaccurate personal information. Identify the authoritative record and the systems that rely on it.

Your process should address relevant service providers and contractors, verification and applicable exceptions. The same operational map helps with deletion and other rights.

Test an example from receipt to completion. If an incorrect customer detail is fixed in one system but reintroduced by an old integration, the underlying process still needs attention.

5. Review contracts and risk-related duties

Supplier arrangements need more than a generic confidentiality promise. The role, permitted purposes, restrictions and required assistance should reflect the actual relationship.

California also adopted regulations covering risk assessments, cybersecurity audits and automated decisionmaking technology, with different applicability tests and phased dates. The CPPA’s 2025 regulations announcement explains the timeline, including risk-assessment obligations beginning in 2026 for covered activities.

Do not assume every small website needs every audit or that all new requirements began together. Screen your activities against the relevant rules, especially when using sensitive information or systems making significant decisions. Keep the resulting review separate from routine banner configuration.

A practical customer journey

A retailer uses browsing activity to create audiences across different services. A customer opts out of sharing and later asks to correct an account detail.

The first request should reach the relevant advertising uses. The second should reach the customer record and applicable connected systems. Neither should depend on the customer knowing which supplier stores the information.

A clear website control, a documented recipient list and a tested request process make both choices easier to honour. They also reduce time spent investigating inconsistent settings after a complaint.

What this means for your team

Treat privacy reviews as part of changes to your marketing setup. A new audience integration, location-based feature or personalisation tool can alter the analysis even when the banner design stays the same.

Keep a short record of what changed, the purpose, the affected data, the supplier’s role and the customer control. This creates a usable basis for future checks without turning every campaign into a full policy rewrite.

Operational checklist

• Check applicability: use current CCPA thresholds and relevant exceptions.
• Check sharing: assess cross-context advertising independently of cash payments.
• Test opt-outs: include browser signals and server-side destinations.
• Check sensitive data: identify categories, purposes and any required limitation control.
• Check retention: align notices, settings and deletion routines.
• Test correction: follow a request through connected systems.
• Check contracts: confirm recipient roles and restrictions match actual use.
• Review new duties: assess current risk, audit and automated-decision rules where relevant.

FAQ