By Daniel de Almeida Afonso · Last updated: October 20, 2026
The California Privacy Rights Act (CPRA) is a 2020 ballot measure, Proposition 24, that amended the California Consumer Privacy Act (CCPA) rather than replacing it. Voters approved it in November 2020, its changes became operative on January 1, 2023, and the law you comply with today is the CCPA as amended. As of October 20, 2026, the CPRA's additions cover sensitive data, rights to correct and limit, data minimization, contractors, a dedicated regulator and, under rules that took effect in 2026, risk assessments, cybersecurity audits and automated decision-making technology (ADMT).
This guide explains what the CPRA is, what it changed compared with the original 2018 CCPA, and where things stand now. It is general information, not legal advice. For a side-by-side of the two texts, see CCPA vs. CPRA: what's the difference. For the GDPR comparison, see GDPR vs CPRA.
The CPRA is an amendment, not a replacement
The CPRA amends Title 1.81.5 of the California Civil Code, the CCPA, and adds new provisions to it. There is no separate "CPRA statute" to read. The consolidated text, starting at Civil Code section 1798.100, is the CCPA as amended, and the California Attorney General's page says the same: the CPRA amends the CCPA and does not create a separate, new law.
You will still see "CCPA 2.0" used for the amended law. In practice, "CCPA" and "CPRA" now describe one body of rules: the statute plus the regulations of the California Privacy Protection Agency (CPPA), found in Title 11 of the California Code of Regulations.
How the CPRA became effective: a short history
Many older articles, including earlier versions of this one, asked when the CPRA would become effective. That question is now history. These are the dates that matter.
| Date | What happened |
|---|---|
| November 2020 | California voters approve Proposition 24 (the CPRA) |
| January 1, 2022 | "Look-back" date: the extended right to request data beyond the 12-month window applies to personal information collected on or after this date |
| January 1, 2023 | The CPRA's amendments become operative; the employee and business-to-business (B2B) exemptions expire |
| March 29, 2023 | Updated CCPA regulations take effect |
| July 1, 2023 | Consumers can file complaints with the CPPA about violations on or after this date |
| February 9, 2024 | A California appeals court reverses a lower-court ruling that had delayed enforcement of the regulations by a year |
| January 1, 2025 | Inflation-adjusted dollar amounts take effect |
| January 1, 2026 | The CPPA's regulations on risk assessments, cybersecurity audits and ADMT take effect |
| January 1, 2027 | Businesses using ADMT for significant decisions must comply with the ADMT rules |
| April 1, 2028 to 2030 | Risk assessment submissions and cybersecurity audit reports start coming due |
Two points explain the middle of the table. First, the statute tied enforcement of the regulations to July 1, 2023. A trial court ruled in 2023 that the CPPA had to wait a year after finalizing its rules. The Third District Court of Appeal disagreed, according to law-firm summaries, and the CPPA could enforce the regulations that had already been finalized. Second, the exemptions for employee and B2B personal information in Civil Code section 1798.145 are marked "inoperative on January 1, 2023" in the statute, so HR, applicant and B2B contact data now carry the same notice and request duties as consumer data.
Who the CPRA applies to
The CPRA keeps the CCPA's focus on for-profit businesses that do business in California, but it changed the tests in Civil Code section 1798.140(d). A business is covered if it meets any one of these:
- Revenue: annual gross revenue above $25,000,000 in the preceding calendar year, "as adjusted." The CPPA's adjustment, effective January 1, 2025, made the figure $26,625,000.
- Data volume: it buys, sells or shares the personal information of 100,000 or more consumers or households a year. The original CCPA test was 50,000 consumers, households or devices.
- Revenue from data: it derives 50% or more of annual revenue from selling or sharing personal information. The original test covered only selling.
The CPPA must adjust the dollar amounts every odd-numbered January, so expect new figures in January 2027. Entities that control or are controlled by a covered business and share its branding are also covered, as are joint ventures in which each business holds at least a 40% interest. Nonprofits and government agencies are generally outside the law.
What the CPRA changed
| Topic | Original CCPA (2018 text) | As amended by the CPRA |
|---|---|---|
| Opt-out | Sale of personal information | Sale and "sharing" for cross-context behavioral advertising |
| Correction | No right | Right to correct inaccurate information |
| Sensitive data | No separate category | "Sensitive personal information" with a right to limit its use |
| Minimization | Not a stated duty | Collection, use and retention must be reasonably necessary and proportionate |
| Retention | No notice duty | Notice of how long each category is kept |
| Vendors | Service providers and third parties | Adds "contractors"; contract terms spelled out |
| Regulator | Attorney General | New agency (CPPA) plus the Attorney General |
| Employee and B2B data | Exempt, temporarily | Exemptions expired January 1, 2023 |
New and changed rights
The rights that existed under the CCPA remain: to know, access, delete, opt out of sale, and not be retaliated against for using a right. The CPRA added or modified:
- Right to correct inaccurate personal information (Civil Code section 1798.106).
- Right to limit the use and disclosure of sensitive personal information to what is needed to provide the requested goods or services (section 1798.121).
- Right to opt out of sharing, not only sale. "Sharing" means disclosing personal information to a third party for cross-context behavioral advertising, whether or not money changes hands (section 1798.140(ah)). This pulls most ad-tech tracking into the opt-out model.
- A longer look-back on the right to know: a consumer can ask for information beyond the 12-month window, covering data collected on or after January 1, 2022, unless that proves impossible or involves disproportionate effort.
- Rights around ADMT: access and opt-out rights for a business's use of automated decision-making technology. The statute directed regulations on this, and the CPPA's rules apply from January 1, 2027 (see below).
Businesses have 45 days to respond to a request, extendable once by another 45 days with notice. Opt-out requests must be honored as soon as feasibly possible and within 15 business days, under the CPPA regulations.
Sensitive personal information
The CPRA created a new subset of personal information under section 1798.140(ae). It covers data that reveals:
- Social Security, driver's license, state ID or passport numbers
- Account log-ins and financial account or card numbers with the required access code
- Precise geolocation
- Racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, or union membership
- The contents of mail, email and text messages, unless the business is the intended recipient
- Genetic data and neural data
- Biometric information processed to uniquely identify a person
- Health information, and information about sex life or sexual orientation
The list has grown since 2020. The current statute text includes neural data and citizenship or immigration status, which the original CPRA list did not name. Unlike the GDPR's special categories, this data is not prohibited. A business that uses it beyond what is needed for the service must give notice and honor a request to limit.
Consent, data minimization and retention
The CPRA defined consent in section 1798.140(h): a freely given, specific, informed and unambiguous indication of wishes, given for a narrowly defined purpose. Accepting broad terms of use, hovering over or closing content, and agreement obtained through dark patterns do not count.
California remains an opt-out state for adults. Opt-in applies mainly to minors: a business must have opt-in authorization before selling or sharing the data of a consumer it knows is under 16 (the teen's own at 13 to 15, a parent's under 13).
The CPRA also added purpose limits and data minimization. Under section 1798.100(c), collection, use, retention and sharing must be reasonably necessary and proportionate to the purposes disclosed. Under section 1798.100(a)(3), the notice at collection must state how long each category is kept, or the criteria used to decide. Retaining it longer than reasonably necessary for the disclosed purpose is not allowed.
Service providers, contractors and third parties
The CPRA added "contractors" next to service providers and third parties (section 1798.140(j)). A contractor receives personal information for a business purpose under a written contract that bars selling or sharing it, bars use outside the business purposes and outside the direct relationship, and bars combining it with other data except as allowed. Section 1798.100(d) requires an agreement with every third party, service provider or contractor that receives personal information. A service provider or contractor cannot provide cross-context behavioral advertising; that is a third-party activity.
The regulator: the California Privacy Protection Agency
The CPRA established the California Privacy Protection Agency in state government (section 1798.199.10). It has a five-member board, full administrative power to implement and enforce the CCPA, and took over rulemaking from the Attorney General. The Attorney General can still bring civil actions. The agency now also uses the name CalPrivacy on its public-facing pages.
The agency's rulemaking is the part of the CPRA that kept moving after 2023. The history, in brief:
- 2023: updated regulations on notices, opt-out preference signals such as Global Privacy Control, an alternative opt-out link ("Your Privacy Choices" or "Your California Privacy Choices") and dark patterns.
- 2025 to 2026: the package on risk assessments, cybersecurity audits and ADMT. The CPPA board adopted it on July 24, 2025, and the Office of Administrative Law approved it on September 22, 2025. It took effect January 1, 2026.
Our CCPA regulations guide covers the full rulemaking history from 2018 on.
The 2026 rules: risk assessments, audits and ADMT
Section 1798.185(a)(14) and (15) told the agency to write rules on cybersecurity audits, risk assessments and ADMT. The approved regulation text sets these dates:
- Risk assessments: required before certain high-risk processing, such as selling or sharing personal information, processing sensitive personal information, or using ADMT for a significant decision. Assessments for processing that began before 2026 are due by December 31, 2027, and submissions covering 2026 and 2027 are due to the CPPA by April 1, 2028.
- Cybersecurity audits: first reports are due April 1, 2028 for businesses with 2026 revenue above $100 million, April 1, 2029 for the next tier and April 1, 2030 for the smallest covered businesses.
- ADMT: a business that uses ADMT for a significant decision before January 1, 2027 must comply by that date. The rules require a pre-use notice and an opt-out or, in some cases, an appeal to a human reviewer.
Our ADMT regulations guide walks through the ADMT steps.
Penalties and enforcement
Fines come from sections 1798.155 (CPPA administrative fines) and 1798.199.90 (Attorney General civil penalties). The statute states $2,500 per violation and $7,500 per intentional violation or one involving a consumer the business knows is under 16, "as adjusted." Per the CPPA's announcement of December 17, 2024, the amounts since January 1, 2025 are:
- $2,663 per violation
- $7,988 per intentional violation or violation involving a consumer under 16
- $107 to $799 per consumer per incident in the private right of action, which is limited to certain data breaches
Fines are counted per violation, so one flawed banner seen by many consumers can add up quickly.
No automatic cure period. The amended statute does not give a business a right to cure before government enforcement. Under section 1798.199.45 the CPPA may choose to give a business time to cure and may consider lack of intent and voluntary fixes, but you cannot count on it. The only mandatory 30-day cure notice that remains is in the breach lawsuit provision, section 1798.150.
Enforcement is real. The CalPrivacy announcement of August 11, 2026 lists CPPA and joint penalties including Honda ($632,500), Todd Snyder ($345,178), Tractor Supply ($1.35 million), Ford ($375,703), PlayOn Sports ($1.10 million) and General Motors ($12.75 million). Several of these cases concerned opt-out requests, opt-out preference signals and vendor contracts. Treat those as the areas regulators check first.
What to do now
- Confirm you are covered. Check revenue against $26,625,000, the 100,000 consumers or households test and the 50% test, including cookie and ad-tech data flows.
- Map personal and sensitive data, with the purpose and retention period for each category, so the notice at collection is accurate.
- Offer working opt-outs. Provide the "Do Not Sell or Share" and "Limit the Use of My Sensitive Personal Information" links, or the alternative opt-out link, and honor Global Privacy Control signals.
- Review vendor contracts for service provider, contractor and third-party terms.
- Handle requests for access, deletion, correction and limits within 45 days, for employees, applicants and business contacts too.
- Plan for 2027 and 2028: identify ADMT used for significant decisions, schedule risk assessments and check whether the audit tests apply.
Our CPRA compliance checklist turns these into task lists, and our CPRA requirements guide covers each obligation in detail.
Secure Privacy is a consent management platform that supports GDPR, CCPA and more than 50 other privacy laws with customizable consent banners.
Frequently asked questions
What is the CPRA?
The California Privacy Rights Act is a 2020 ballot measure, Proposition 24, that amended the California Consumer Privacy Act. It added rights to correct and to limit use of sensitive data, extended opt-out to sharing, introduced data minimization and retention limits, and created the California Privacy Protection Agency.
Does the CPRA replace the CCPA?
No. The CPRA amends the CCPA and adds provisions to the same Civil Code title. The law in force is the CCPA as amended by the CPRA, together with the CPPA's regulations.
When did the CPRA take effect?
Its amendments became operative on January 1, 2023, with some access rights reaching back to personal information collected on or after January 1, 2022. Consumers could file complaints with the CPPA about violations from July 1, 2023, and the agency's newest rules on risk assessments, audits and ADMT took effect January 1, 2026.
Who has to comply with the CPRA?
A for-profit business that does business in California and meets one test: revenue above $26,625,000, buying, selling or sharing the data of 100,000 or more consumers or households, or earning 50% or more of revenue from selling or sharing personal information. The dollar figure is adjusted every odd-numbered January.
What new rights does the CPRA give consumers?
The right to correct inaccurate personal information, the right to limit the use of sensitive personal information, the right to opt out of sharing for cross-context behavioral advertising, and access and opt-out rights for automated decision-making technology under the CPPA's rules from January 1, 2027.
Is there a cure period under the CPRA?
Not automatically. The CPPA may decide to give a business time to cure, but the law does not require it. A 30-day cure notice still applies before a consumer sues for statutory damages after a data breach.
Does the CPRA apply to employee and B2B data?
Yes. The temporary exemptions for employee, applicant and business-to-business data expired on January 1, 2023, so those individuals have the same rights as other California residents.
