CPRA
California Consumer Privacy Act / California Privacy Rights Act
Key Facts
Overview
The CPRA (California Privacy Rights Act) is the most comprehensive US state privacy law and the only one with a dedicated enforcement agency — the California Privacy Protection Agency (CPPA). It defines cross-context behavioral advertising via cookies as "sharing" personal information, making cookie-based ad tracking subject to opt-out requirements.
What This Means for Your Website
- A "Do Not Sell or Share My Personal Information" link must be prominently displayed
- You must honor Global Privacy Control (GPC) signals as valid opt-out requests
- Cross-context behavioral advertising via cookies triggers opt-out obligations
- Consumers have rights to know, delete, correct, and port their personal information
- Sensitive data requires opt-in consent or the right to limit use and disclosure
- Under 16: opt-in consent required for sale/sharing. Under 13: verifiable parental consent
- Data minimization limits collection to disclosed purposes
Key Requirements
The CPPA and California AG enforce the CPRA with penalties of $2,500 per unintentional and $7,500 per intentional violation. Consumer requests must be fulfilled within 45 days. There is no mandatory cure period. A limited private right of action exists for data breaches involving unencrypted PI ($100-$750 per consumer). Privacy risk assessments are required for high-risk processing.
How ConsentStack Handles This
ConsentStack automatically detects California visitors and shows a CPRA-compliant opt-out banner with a Do Not Sell or Share link. GPC signals are honored automatically, and consent preferences are recorded for audit compliance.
Penalties
$2,500 per unintentional violation / $7,500 per intentional violation.
Key Requirements
- Do Not Sell or Share My Personal Information link required
- Honor Global Privacy Control (GPC) signals
- Right to know, delete, correct, and port personal information
- Data minimization — collection limited to disclosed purposes
- Privacy risk assessments for high-risk processing
- Service provider and contractor contractual requirements
Notable Provisions
- Dedicated agency (CPPA) — unique among US states
- Cross-context behavioral advertising via cookies equals sharing
- First US state law to require honoring GPC signals
Data Subject Rights
Right to know what personal information is collected, used, shared, or sold
Right to request deletion of personal information collected from the consumer
Right to request correction of inaccurate personal information
Right to opt out of the sale or sharing of personal information
Right to limit the use and disclosure of sensitive personal information
Right not to be discriminated against for exercising privacy rights
US State Specifics
Other North America Regulations
Frequently Asked Questions
Does CPRA require a cookie consent banner?
CPRA requires a Do Not Sell or Share My Personal Information link and honoring of GPC signals. ConsentStack implements both automatically for California visitors.
What is the CPPA?
The California Privacy Protection Agency is the dedicated enforcement agency for the CPRA — the only US state with its own privacy agency.
Must websites honor GPC signals under CPRA?
Yes. CPRA was the first US state law to require honoring Global Privacy Control signals as valid opt-out requests. ConsentStack detects and honors GPC automatically.
What are the CPRA penalties?
$2,500 per unintentional violation and $7,500 per intentional violation. There is no mandatory cure period.
Stay compliant with CPRA
ConsentStack helps you implement Opt-out consent for California, United States automatically.