What Is CCPA/CPRA? California's Privacy Law Explained
The California Consumer Privacy Act, the CPRA amendments that expanded it, and the rights and obligations they create.
8 min read
The California Consumer Privacy Act (CCPA) is the United States' first comprehensive consumer privacy law, and it remains the most influential. Amended and expanded by the California Privacy Rights Act (CPRA), it sets the rights Californians have over their personal information and the obligations businesses have when they collect it. Most US state privacy laws that followed borrow heavily from it.
CCPA and CPRA: One Law, Two Layers
CCPA took effect in 2020. CPRA, passed by ballot initiative, amended and strengthened it, with its main provisions operative from 2023. In practice, people say "CCPA/CPRA" to mean the current California law as amended. CPRA's biggest additions were a new category of sensitive personal information, the right to correction, tighter rules on data retention, and a dedicated regulator.
The Regulator: The CPPA
CPRA created the California Privacy Protection Agency (CPPA), the first US agency dedicated to privacy enforcement. The CPPA writes the detailed regulations that put the law into practice, including the newer rules on automated decision-making and risk assessments, and it enforces alongside the California Attorney General.
The Rights It Grants
California residents have the right to:
- Know what personal information a business collects and how it is used and shared.
- Delete personal information a business has collected, subject to exceptions.
- Correct inaccurate personal information.
- Opt out of the sale or sharing of their personal information.
- Limit the use of sensitive personal information.
- Non-discrimination for exercising these rights.
For how "sell" and "share" actually work, see Do Not Sell or Share.
Who Has to Comply
CCPA/CPRA applies to for-profit businesses that handle Californians' data and meet a threshold, such as a revenue floor or processing data at scale. If you sell to or track California consumers and are a business of any real size, assume you are likely in scope and confirm against the current thresholds.
How Concord Fits
CCPA/CPRA compliance runs on the same operational levers as the rest of privacy: a compliant opt-out and consent experience, a way to handle consumer requests, and a map of where personal information lives. Concord Privacy brings those together, so meeting California's rules is the same workflow you use for every other jurisdiction.