CCPA vs CPRA: What California’s Privacy Law Requires Today
The CCPA came first in 2018. The CPRA rewrote it in 2020. Here is what each one did, what changed and what applies to your business now.
The CPRA did not replace the CCPA. It amended it.
The rules you follow today are the CCPA as amended by the CPRA, plus CalPrivacy’s regulations.
CCPA and CPRA, explained
The California Consumer Privacy Act was signed in June 2018 and took effect January 1, 2020. It gave Californians the right to know what personal information a business collects about them, to have it deleted and to opt out of its sale.
In November 2020, voters approved Proposition 24, the California Privacy Rights Act. It added new rights, a category called sensitive personal information, data minimization and security duties, and an independent regulator. Most of its changes took effect January 1, 2023.
So when people say CCPA today, they mean the amended law. When they say CPRA, they usually mean the 2020 changes.
From the first law to the first audits
CCPA signed into law.
CCPA takes effect.The Attorney General began enforcing it on July 1, 2020.
Voters approve Proposition 24, the CPRA.It also created the California Privacy Protection Agency, now called CalPrivacy.
Most CPRA amendments take effect.The temporary exemptions for employee and business-to-business data ended.
CPRA changes become enforceable.CalPrivacy and the Attorney General both enforce the CCPA.
New regulations take effect: cybersecurity audits, risk assessments, automated decision-making and updated CCPA rules.Breach notices to residents are due within 30 days under SB 446.
Automated decision-making rules apply to existing uses.SB 923 widens the right to delete; AB 566 requires browsers to offer an opt-out signal.
Risk assessments due for processing that began before 2026 and continues.
First risk assessment submissions, and first cybersecurity audits for businesses with more than $100 million in 2026 revenue.Smaller businesses follow on April 1, 2029 and April 1, 2030.
The original CCPA compared with the law today
| Topic | Original CCPA (2020) | CCPA as amended by the CPRA (today) |
|---|---|---|
| Consumer rights | Know, delete, opt out of sale, non-discrimination | Adds the rights to correct, to opt out of sharing for cross-context behavioral advertising and to limit the use of sensitive personal information |
| Sensitive personal information | Not a separate category | A defined category, including government ID numbers, log-in credentials, precise geolocation, and health and biometric data, with a right to limit its use |
| Regulator | Attorney General only | Attorney General plus CalPrivacy, with rulemaking, audit and enforcement powers |
| Right to cure | 30 days to cure a violation after notice | Automatic cure period removed for regulator enforcement |
| Employees and B2B contacts | Mostly exempt (temporarily) | Fully covered since January 1, 2023 |
| Volume threshold | 50,000 consumers, households or devices | 100,000 consumers or households a year; devices removed |
| Revenue threshold | $25 million | $25 million adjusted for inflation: $26,625,000 since January 1, 2025 |
| Sharing | Not covered as a separate concept | Disclosure for cross-context behavioral advertising counts as sharing, even without payment |
| Data minimization | No explicit rule | Collection, use and retention must be reasonably necessary and proportionate |
| Security | Enforced through breach lawsuits | An explicit duty to implement reasonable security, plus cybersecurity audits and risk assessments by regulation |
Four terms that decide your obligations
Sale
Disclosing personal information to a third party for money or other valuable consideration. Data brokers are the obvious case, but swaps of customer lists can count too.
Sharing
Disclosing personal information to a third party for cross-context behavioral advertising, whether or not money changes hands. Advertising pixels on a website are a common example.
Sensitive personal information
Includes Social Security, driver’s license, state ID and passport numbers; account log-ins and financial account or card numbers with the password or code that opens them; precise geolocation; racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs and union membership; the contents of mail, email and texts sent to others; genetic and neural data; biometric data used to identify someone; and health, sex life and sexual orientation information.
Service provider vs third party
A service provider or contractor processes data for you under a contract with required terms. A third party uses it for its own purposes. The difference decides whether a disclosure is a sale or sharing.
The thresholds that changed
consumers or households a year: the buy, sell or share threshold since 2023 (it was 50,000, including devices)
Source: Civil Code §1798.140(d)revenue threshold since January 1, 2025, adjusted from $25 million
Source: CalPrivacy monetary adjustmentconsumer complaints received by CalPrivacy from July 2023 to March 2026
Source: CalPrivacy enforcement update, May 2026cybersecurity audit, risk assessment and ADMT regulations took effect
Source: CalPrivacy rulemaking pageTwo regulators and, after a breach, consumers
California Attorney General
Brings civil actions with penalties and injunctions. Its $12.75 million settlement with General Motors in May 2026 is the largest announced CCPA settlement as of October 2026.
CalPrivacy
Writes the regulations, audits businesses and issues administrative fines. It also runs the data broker registry and the DROP deletion platform.
Consumers
Can sue after a breach of their nonencrypted and nonredacted personal information caused by a failure to maintain reasonable security, for $107 to $799 per consumer per incident or actual damages.
Now check whether the law applies to you
Check the three thresholds
Revenue, volume of personal information and revenue from selling or sharing it. Meeting one generally brings a business under the CCPA; confirm with counsel.
Learn the rights you must support
Know, delete, correct, opt out and limit, with deadlines and verification rules.
Page 2 of 10: CCPA vs CPRA explained
- 1. CCPA and CPRA compliance (hub)
- 2. CCPA vs CPRA explained (this page)
- 3. Does the CCPA apply to your business?
- 4. Consumer rights and privacy requests
- 5. Penalties, fines and lawsuits
- 6. Implementation roadmap
- 7. CCPA for IT administrators
- 8. CCPA cybersecurity audit
- 9. Risk assessments and ADMT
- 10. CCPA compliance checklist
Guided by Ali Hassani, CISSP, C|CISO
Certified CISO (C|CISO) and CISSP with 25+ years in IT, cybersecurity, compliance and infrastructure, who has earned dozens of Microsoft and Cisco certifications over his career, including MCSE, MCITP, MCSA Security, CCNP and CCNA. OC Security Audit handles the technical side of the CCPA: data inventories, security controls and evidence as your readiness advisor, or the cybersecurity audit as your independent auditor, one role per program. Legal interpretation stays with your privacy counsel.
Questions business owners and IT leaders ask
Do we need separate CCPA and CPRA programs?
No. Build one program for the CCPA as amended by the CPRA, including CalPrivacy’s regulations.
What is CalPrivacy?
The California Privacy Protection Agency, created by the CPRA. It adopts regulations, audits and enforces the CCPA, and runs the data broker registry and the DROP deletion platform.
Did the CPRA change who is covered?
Yes. It raised the volume threshold from 50,000 to 100,000 consumers or households, removed devices, added sharing for advertising to the thresholds and let the temporary employee and business-to-business exemptions expire on January 1, 2023.
Is there still a 30-day right to cure?
Not automatically for regulator enforcement. A 30-day notice-and-cure step still applies before consumers sue for statutory damages after a breach.
Do we have to honor Global Privacy Control?
Yes, if you sell or share personal information. A valid opt-out preference signal such as Global Privacy Control must be treated as a request to opt out.
General information, not legal advice
This page summarizes California privacy law and regulations as of October 2026 to help businesses plan their cybersecurity and IT work. It is general information, not legal advice. It does not create an attorney-client relationship and does not guarantee compliance or any outcome. OC Security Audit is a cybersecurity firm, not a law firm. Confirm how the CCPA applies to your business with qualified California privacy counsel. Enforcement examples summarize the regulators’ public announcements; settlements can resolve allegations without an admission of wrongdoing. Laws, regulations and inflation-adjusted amounts change, so check the primary sources below.
Primary sources · Last reviewed October 2026
- California Civil Code, Title 1.81.5: California Consumer Privacy Act
- CalPrivacy: CCPA updates, cybersecurity audit, risk assessment and ADMT rulemaking
- CalPrivacy: text of the CCPA regulations on cybersecurity audits, risk assessments and ADMT (effective January 1, 2026)
- CalPrivacy: updated monetary thresholds in the CCPA (effective January 1, 2025)
- CalPrivacy: annual enforcement update, board meeting of May 1, 2026
- California Attorney General: General Motors settlement, May 8, 2026
- California Legislature: SB 446, data breach notification deadlines
- CalPrivacy: SB 923 strengthens deletion rights (signed September 27, 2026)
- California Legislature: AB 566, California Opt Me Out Act
- Global Privacy Control specification and browser support
Turn the law into a short list of tasks
Schedule a consultation. We turn the technical side of the CCPA into a task list for your team, starting with the gaps that carry the most risk.
Read-only reviews. Irvine, Orange County and Southern California on-site; remote nationwide.