By Daniel de Almeida Afonso · Last updated: October 7, 2026
"CCPA 2.0" is the nickname for the California Privacy Rights Act (CPRA), the ballot measure that California voters approved as Proposition 24 on November 3, 2020. It amended the California Consumer Privacy Act (CCPA) rather than replacing it, and most of its changes became operative on January 1, 2023.
Earlier versions of this page covered the initiative while it was still a proposal, under its working title, the California Privacy Rights and Enforcement Act (CPREA). That story is finished. This update tells it from start to end: who proposed CCPA 2.0, how the text changed before the vote, what voters passed, and what was dropped along the way. It also folds in what early-2021 guides, including ours, called "upcoming changes." All of those changes are now law, so they are stated here as such.
For current compliance detail, this page points you to our other guides instead of repeating them.
What is CCPA 2.0?
CCPA 2.0, the CPREA draft and the CPRA are three names for one project. All of them trace to Alastair Mactaggart, founder of the advocacy group Californians for Consumer Privacy.
- CCPA 2.0: the informal name used by the press and the privacy industry from late 2019.
- CPREA: the official title of the draft filed in 2019, the California Privacy Rights and Enforcement Act of 2020.
- CPRA or Prop 24: the name of the measure that reached the November 2020 ballot and became law.
It is not a separate statute you must comply with alongside the CCPA. Today there is one law, the CCPA as amended by the CPRA.
How CCPA 2.0 started: the first initiative and the 2018 deal
Mactaggart's first privacy initiative qualified for the 2018 ballot after more than 629,000 Californians signed petitions. Lawmakers and the technology industry then negotiated a compromise. The Legislature passed the CCPA (AB 375) in June 2018, and Mactaggart withdrew the initiative.
The CCPA took effect on January 1, 2020. Mactaggart's group argued that the legislative version was weaker than the original and that industry would keep trying to dilute it. A ballot measure was the answer, because California voter-approved initiatives are much harder for the Legislature to weaken.
Timeline: from filing to the ballot box
The initiative went through several drafts before it was fixed. The dates below come from the California Attorney General's initiative filings and public reporting.
| Date | Event |
|---|---|
| September 25, 2019 | Mactaggart files the first 51-page draft, "CCPA 2.0," with the California Attorney General. |
| October 2, 2019 | A second version is filed. |
| October 9, 2019 | Version 3 is submitted. |
| November 13, 2019 | The Attorney General's office receives amendments to Version 3. |
| Spring 2020 | Californians for Consumer Privacy submits more than 900,000 signatures. The measure needed 623,212. |
| June 24, 2020 | The Secretary of State confirms the measure has enough valid signatures for the November ballot. |
| November 3, 2020 | Voters approve Proposition 24. |
| January 1, 2023 | The main provisions become operative. |
| July 1, 2023 | Consumers can file complaints with the new California Privacy Protection Agency (CPPA) for violations on or after that date. |
Some older coverage places the revised filing in December 2019. The Attorney General's own records show the amended Version 3 arrived on November 13, 2019, so the timeline above uses that date.
The Prop 24 result
Proposition 24 passed with about 56 percent of the vote. Roughly 9.38 million Californians voted yes and 7.31 million voted no.
The measure did not take effect right away. It gave businesses two years to prepare:
- It applied to personal information collected on or after January 1, 2022.
- Most provisions became operative on January 1, 2023.
- The statute set July 1, 2022 as the deadline for implementing regulations. The CPPA's rulemaking ran well past that date, and it is still producing rules.
What did Prop 24 change?
The 2019 drafts and the final law overlap heavily, but they are not identical. Here is what the passed law did, based on the official ballot text and the CPPA and Attorney General guidance.
- Created the CPPA. Prop 24 established the California Privacy Protection Agency, governed by a five-member board. It shares enforcement of the CCPA with the Attorney General and writes the regulations.
- Raised the consumer threshold. A business is covered if it buys, sells or shares the personal information of 100,000 or more California residents or households. The old figure was 50,000.
- Added "sharing." Sharing personal information for cross-context behavioral advertising became its own regulated activity, separate from "sale." This is the legal home of the opt-out for targeted ads.
- Added sensitive personal information. Precise geolocation, health data, race or ethnicity, biometric and genetic data, and similar categories got a separate right to limit use and disclosure.
- Added new rights. Consumers gained a right to correct inaccurate information, and the law set up rules for opting out of automated decision-making and profiling.
- Wrote in data-protection principles. Data minimization, purpose limitation and storage limitation entered the statute, along with a duty to disclose how long you keep each category of data.
- Tightened vendor rules. The law defines three roles: service providers, contractors and third parties. Contracts must restrict what each can do with the data.
- Changed the cure period. The mandatory 30-day window to fix a violation no longer applies as a right in regulator enforcement. The CPPA may still choose to give a business time to cure. The 30-day cure for consumer breach lawsuits stayed, as explained below.
- Ended the employee and B2B exemptions. The partial exemptions expired on January 1, 2023.
The revenue test also moved. California adjusts the dollar figure for inflation, and the CPPA now states the threshold as gross annual revenue of $26.625 million or more, effective January 1, 2025. The Attorney General's page still shows the original $25 million figure, so check the CPPA's number.
CCPA 2.0 vs. the original CCPA: the changes in detail
Guides written after the vote framed these items as a to-do list for 2023. The statute text posted by the CPPA now settles each one. The sections below cover only what the original CCPA lacked. For a right-by-right comparison, use our CCPA vs. CPRA guide.
Sensitive personal information
Prop 24 created this category. The statute now lists:
- Social Security, driver's license, state ID and passport numbers.
- An account log-in, financial account, debit card or credit card number together with the code or password that opens the account.
- Precise geolocation.
- Racial or ethnic origin, religious or philosophical beliefs, and union membership.
- The contents of mail, email and text messages, unless the business is the intended recipient.
- Genetic data.
- Biometric information processed to identify a person, health information, and information about sex life or sexual orientation.
The current text also lists neural data and citizenship or immigration status. Later amendments added those two, so they were not part of what voters approved.
Consent
The statute defines consent as a freely given, specific, informed and unambiguous indication of the consumer's wishes, given by a statement or a clear affirmative action, for a narrowly defined purpose. It also says what does not count:
- Accepting general terms of use that bundle in unrelated information.
- Hovering over, muting, pausing or closing content.
- Agreement obtained through dark patterns.
This is close to the GDPR's idea of consent, but the CCPA remains mainly an opt-out law. The definition matters where the statute asks for consent, for example for minors' data. Our consent requirements guide covers how to apply it on a website.
Children's data
A business must not sell or share personal information when it has actual knowledge that the consumer is under 16, unless the consumer (ages 13 to 15) or a parent or guardian (under 13) has affirmatively authorized it. A business that willfully disregards a consumer's age is treated as having actual knowledge.
Two points correct older coverage. First, the opt-in applies to sale and sharing, not to collection. Second, the penalty is higher, not a separate fine: violations involving consumers known to be under 16 fall in the top penalty tier, up to $7,500 per violation against $2,500 for an ordinary one. That is three times as much. The CPPA adjusts these figures for inflation, and its current amounts are $2,663 and $7,988. Both the CPPA (administrative fines) and the Attorney General (civil penalties) can seek them.
Notice at collection and the opt-out links
At or before the point of collection, a business must tell consumers:
- The categories of personal information collected, why, and whether it is sold or shared.
- The same details for any sensitive personal information.
- How long it keeps each category, or the criteria it uses to decide. It may not keep data longer than reasonably necessary for the disclosed purpose.
A business that sells or shares personal information, or uses sensitive personal information beyond the permitted purposes, must post two homepage links: "Do Not Sell or Share My Personal Information" and "Limit the Use of My Sensitive Personal Information." It may use a single clearly labeled link that does both jobs. Alternatively, it can honor an opt-out preference signal sent by the consumer's browser or platform.
Security duty and breach lawsuits
The statute now requires reasonable security procedures appropriate to the nature of the information. It does not name specific controls. The CPPA's cybersecurity audit rules, mentioned below, add detail for the highest-risk businesses.
The private right of action in Section 1798.150 is the only one in the law. Prop 24 widened it to cover an email address in combination with a password or security question and answer. A consumer can sue when that data, or other nonencrypted personal information of the kinds listed in California's breach statute, is stolen or disclosed because the business failed to keep reasonable security. Statutory damages are $100 to $750 per consumer per incident, or actual damages if higher. The CPPA's current adjusted range is $107 to $799.
Older guides said the cure period disappeared for breaches. That is only half right. The 30-day notice and cure step still exists for these lawsuits, but fixing security after a breach does not count as a cure.
Service providers and contracts
A service provider is defined by its contract. The contract must bar the provider from selling or sharing the data, from using it outside the specified business purposes or the direct relationship with the business, and from combining it with data from other sources, with limited exceptions.
When a business sells or shares data, or discloses it to a service provider or contractor, the agreement must also:
- Limit the disclosure to specified purposes.
- Require the same level of privacy protection the law requires.
- Let the business take reasonable steps to check the data is used properly.
- Require the other party to say if it can no longer meet its obligations.
- Let the business stop and remediate unauthorized use.
Preemption
The CCPA declares itself a matter of statewide concern. It supersedes and preempts city, county and other local rules about a business's collection and sale of personal information. That clause speaks only to local law. It does not address federal law or other states' laws.
What was in the 2019 drafts but not in the final law?
Not everything proposed in 2019 survived. If you have read older coverage, these are the points that most often cause confusion.
- Opt-in before sale of sensitive data. The drafts described an opt-in model for sensitive information. The final law instead gave consumers a right to limit its use and disclosure.
- A detailed profiling disclosure. Drafts spelled out profiling duties in the statute. The final law left the detail to regulations, and the CPPA's rules on automated decision-making, risk assessments and cybersecurity audits have compliance dates beginning January 1, 2026, with phased deadlines in 2027 and 2028.
- A 200,000 consumer threshold. Some 2019 coverage reported a 200,000 figure for a revised draft. We could not confirm it. The Version 3 amendment filed with the Attorney General shows 100,000, which is also what the law says today.
- Delayed employee and B2B exemptions. The drafts extended these exemptions to January 1, 2023. They ended on that date and were not extended again.
What should you read for current compliance?
This page is history. It will not tell you what to do this quarter. These guides cover that, each from a different angle:
- CCPA vs. CPRA: What's the Difference? compares the original statute with the amended one, right by right.
- What is CCPA? is the starting point if you are new to California privacy law.
- CCPA and CPRA Consent Requirements explains what cookie compliance actually requires, including opt-out signals.
- CPRA Guide: Full Text Summary walks through the statute section by section.
For the law itself, use the primary sources. The California Attorney General's CCPA page lists the current thresholds and rights. The CPPA publishes the regulations and enforcement updates. The Version 3 initiative filing_1.pdf) is the document that became Prop 24.
FAQ
Is CCPA 2.0 the same as the CPRA?
Yes. CCPA 2.0 is an informal name for the California Privacy Rights Act, which voters passed as Proposition 24 in November 2020. The draft was first called the California Privacy Rights and Enforcement Act (CPREA).
Did CCPA 2.0 pass?
Yes. Proposition 24 passed on November 3, 2020 with about 56 percent of the vote. Most of its provisions became operative on January 1, 2023.
Does CCPA 2.0 replace the CCPA?
No. The CPRA amended the CCPA, so the two now work as one law. Businesses follow the CCPA as amended.
Who proposed CCPA 2.0?
Alastair Mactaggart, the founder of Californians for Consumer Privacy. He also led the 2018 initiative that pushed the Legislature to pass the original CCPA.
Who enforces the law now?
Both the California Attorney General and the California Privacy Protection Agency. The CPPA was created by Prop 24 and also writes the regulations.
Does my business have to comply?
Possibly. A for-profit business doing business in California is covered if it has gross annual revenue of $26.625 million or more, handles the data of 100,000 or more California residents or households, or earns 50 percent or more of revenue from selling or sharing personal information. Confirm your position against the CPPA's guidance.
Can a business sell the data of children under 16?
Only with opt-in. If the business knows the consumer is under 16, it needs the consumer's own authorization at ages 13 to 15, or a parent's or guardian's authorization under 13. Ignoring a consumer's age on purpose counts as knowing it.
What counts as valid consent under the CPRA?
A freely given, specific, informed and unambiguous indication of wishes, by a statement or clear affirmative action, for a narrowly defined purpose. Accepting broad terms of use, closing a banner or agreeing through a dark pattern does not count.
What is the difference between a service provider, a contractor and a third party?
All three receive personal information from a business, but the contract and the allowed uses differ. Service providers and contractors process data for the business under restrictions. Third parties receive data for their own purposes, and passing data to them can count as a sale or sharing.
Final thoughts
CCPA 2.0 started as a 51-page filing in September 2019 and became California law 14 months later. The text changed along the way, and some of the 2019 headlines did not make it into the final statute.
If you are building a compliance program today, start from the law as passed. Use this page for context and the guides above for the work.
