CCPA vs CPRA: Key Differences Explained (2026)

The California Privacy Rights Act (CPRA) is Proposition 24, the November 2020 ballot measure that amended the California Consumer Privacy Act (CCPA), and its changes took effect on January 1, 2023. It added the right to correct inaccurate personal information and the right to limit use of sensitive personal information, extended the opt-out from the sale of data to its sharing for cross-context behavioral advertising, and created the California Privacy Protection Agency to enforce the law.

The CPRA did not replace the CCPA. It built on it. The official statute is still titled the "California Consumer Privacy Act of 2018," but its provisions now include every change the CPRA introduced. Understanding what changed, and when, is essential for businesses navigating California privacy compliance in 2026.

Timeline: From CCPA to CPRA

Understanding the timeline helps clarify which provisions apply and when they took effect.

Side-by-Side Comparison: CCPA (Original) vs. CPRA Amendments

The following table compares the original CCPA provisions with what the CPRA changed or added.

New Consumer Rights Under the CPRA

The CPRA added two entirely new rights and expanded an existing one.

Right to Correct Inaccurate Personal Information

Consumers can now request that a business correct inaccurate personal information it maintains. The business must use commercially reasonable efforts to correct the data after receiving a verified request.

This right did not exist under the original CCPA. It mirrors similar provisions in the European Union's General Data Protection Regulation (GDPR).

Right to Limit Use of Sensitive Personal Information

The CPRA created the concept of sensitive personal information as a distinct legal category. Consumers can direct businesses to limit their use of sensitive PI to what is strictly necessary to perform the services or provide the goods the consumer requested.

Sensitive personal information includes:

• Government identifiers (Social Security numbers, driver's license numbers)
• Financial account credentials
• Precise geolocation
• Racial or ethnic origin, citizenship or immigration status, religious beliefs, union membership
• Contents of private communications (mail, email, texts)
• Genetic and biometric data
• Health, sex life, or sexual orientation data
• Neural data (added by SB 1223 in 2024)

Businesses that use or disclose sensitive personal information beyond what is necessary must post a "Limit the Use of My Sensitive Personal Information" link on their homepage.

Expanded Opt-Out: Sale AND Sharing

The original CCPA gave consumers the right to opt out of the "sale" of their personal information. The CPRA expanded this to include "sharing," which the statute defines as making personal information available to a third party for cross-context behavioral advertising.

This change closed a significant loophole. Under the original CCPA, some businesses argued that transferring data to advertising partners was not a "sale" because no money changed hands. The CPRA's broader definition of "sharing" captures these data transfers regardless of whether monetary consideration is involved.

The required homepage link changed from "Do Not Sell My Personal Information" to "Do Not Sell or Share My Personal Information."

For data brokers, California also offers a single request. Under the Delete Act (SB 362), the CPPA's Delete Request and Opt-out Platform (DROP), live since its regulations took effect January 1, 2026, lets a consumer ask every data broker registered with the state to delete their non-exempt personal information through one request to the agency.

Employee and B2B Data: Temporary Exemptions Expired

The original CCPA temporarily exempted personal information collected in the employment context and in business-to-business (B2B) transactions from most consumer rights. That carve-out was never extended by the legislature, and it expired on December 31, 2022, per Civ. Code Sec. 1798.145(m)-(n) and the California Attorney General's own CCPA FAQ.

Since January 1, 2023, the same date the rest of the CPRA amendments took effect, employee and job-applicant personal information and B2B personal information are fully subject to CCPA/CPRA consumer rights and business obligations, just like any other consumer's data.

The CPPA: A New Enforcement Agency

One of the CPRA's most significant structural changes was creating the California Privacy Protection Agency, the first agency in the United States dedicated solely to consumer data privacy.

CPPA vs. Attorney General Enforcement

The CPPA has already demonstrated active enforcement. In 2025, the agency settled cases against American Honda Motor Co. ($632,500), Tractor Supply Company ($1.35 million), and Todd Snyder, Inc. ($345,178).

Elimination of the 30-Day Cure Period for Government Enforcement

Under the original CCPA, the Attorney General had to give businesses a 30-day notice to "cure" violations before bringing enforcement action. The CPRA eliminated that cure period on the government enforcement track. The Attorney General and the CPPA can now pursue penalties without first offering an opportunity to fix the problem.

The CPRA did not eliminate the cure period that applies to private lawsuits. Civ. Code Sec. 1798.150(b) still requires a consumer, before initiating any action against a business for statutory damages on an individual or class-wide basis, to give the business "30 days' written notice identifying the specific provisions of this title the consumer alleges have been or are being violated." Where a cure is possible and the business cures within those 30 days and provides an express written statement that the violations have been cured and that no further violations will occur, no statutory damages action may be initiated. No notice is required before a consumer sues solely for actual pecuniary damages.

The Private Right of Action for Data Breaches

Most CCPA violations are enforceable only by the Attorney General or the CPPA. Civ. Code Sec. 1798.150 is the narrow exception: a consumer may sue when nonencrypted and nonredacted personal information is subject to unauthorized access and exfiltration, theft, or disclosure as a result of the business's failure to implement and maintain reasonable security procedures. Subdivision (c) confines the claim to violations defined in subdivision (a), so it cannot be used to enforce any other section of the law.

The CPRA widened this claim. Proposition 24 amended Sec. 1798.150(a)(1) to reach a consumer "whose email address in combination with a password or security question and answer that would permit access to the account" is breached, language the original 2018 statute did not contain. Statutory damages are set at $100 to $750 per consumer per incident, or actual damages if greater, and the CPPA's CPI adjustment raised that range to $107 to $799 effective January 1, 2025.

Contractor Obligations: A New Category

The original CCPA regulated "businesses" and "service providers." The CPRA added a third category: "contractors."

Service Providers vs. Contractors

Businesses must include specific CCPA-compliant provisions in their contracts with both service providers and contractors, including prohibitions on selling or sharing the data, retention limitations, and requirements to assist with consumer rights requests.

Risk Assessments and Cybersecurity Audits

The CPRA directed the CPPA to develop regulations requiring certain businesses to conduct privacy risk assessments and cybersecurity audits. The CPPA finalized these regulations in September 2025, effective January 1, 2026.

Risk Assessment Requirements

Businesses must conduct risk assessments for processing activities that present "significant risk" to consumer privacy. This includes:

• Selling or sharing personal information
• Processing sensitive personal information
• Using automated decisionmaking technology for significant decisions
• Processing personal information of children or consumers the business knows to be under 16

Risk assessments must weigh the benefits of the processing against the potential risks to consumer privacy. Businesses must submit attestations and summaries to the CPPA by April 1, 2028.

Cybersecurity Audit Requirements

Certain businesses must conduct annual cybersecurity audits that assess whether their security practices are appropriate for the nature and volume of personal information they process. The audit must evaluate the business's ability to:

• Protect personal information from unauthorized access, destruction, use, modification, or disclosure
• Identify and address security gaps
• Respond to security incidents

Opt-Out Preference Signals

The CPRA codified the concept of opt-out preference signals (OOPS), requiring businesses to treat browser-level privacy signals as valid opt-out requests.

Global Privacy Control (GPC)

The most widely used opt-out preference signal is Global Privacy Control (GPC), available as a built-in feature in browsers like Mozilla Firefox, DuckDuckGo, and Brave, or as a browser extension.

When GPC is enabled, it automatically sends a signal to every website the consumer visits indicating they want to opt out of the sale and sharing of their personal information. Businesses must honor this signal the same way they would honor a consumer clicking the "Do Not Sell or Share My Personal Information" link.

The Attorney General's enforcement action against Sephora in 2022 was partly based on the company's failure to recognize GPC signals. In 2025, the AG and CPPA launched a joint investigative sweep with Colorado and Connecticut to investigate businesses refusing to honor opt-out preference signals.

Alternative Opt-Out Links

Businesses that process opt-out preference signals can use a single, combined link (such as "Your Privacy Choices") instead of separate "Do Not Sell or Share" and "Limit the Use of My Sensitive Personal Information" links, provided the response to the signal is frictionless for the consumer.

Automated Decisionmaking Technology (ADMT)

The CPRA's most forward-looking provision addresses automated decisionmaking technology. Under regulations finalized in 2025:

• Businesses that use ADMT to make "significant decisions" about consumers must provide pre-use notice
• Consumers can request information about how ADMT was used in decisions affecting them
• Consumers can opt out of certain ADMT uses
• These requirements take effect January 1, 2027

Significant decisions include those that produce legal or similarly significant effects concerning access to financial services, housing, insurance, education, employment, health care, or essential goods and services.

Data Minimization and Purpose Limitation

The CPRA introduced explicit data minimization requirements that the original CCPA lacked. Under the amended statute, businesses:

• May only collect personal information that is "reasonably necessary and proportionate" to achieve the purposes for which it was collected or processed
• Cannot retain personal information longer than reasonably necessary for the disclosed purpose
• Cannot use personal information for purposes incompatible with those disclosed at the time of collection without providing new notice

These requirements align California law more closely with the GDPR's data minimization principles.

Practical Impact for Businesses

The shift from the original CCPA to the CPRA-amended version affects day-to-day operations in several concrete ways:

1. Privacy policies need updating to address new rights (correction, sensitive PI limitation) and new categories (contractors)
2. Homepage links changed from "Do Not Sell My Personal Information" to "Do Not Sell or Share My Personal Information" with an optional "Limit the Use of My Sensitive Personal Information" link
3. Vendor contracts must distinguish between service providers and contractors with appropriate CCPA terms
4. Technical infrastructure must detect and honor opt-out preference signals like GPC
5. Risk assessment programs are now mandatory for businesses that process data in high-risk ways
6. Employee training must cover new rights, new categories of data, and new enforcement realities

For a step-by-step guide to meeting these requirements, see our CCPA Compliance Checklist.

Related California Privacy Topics

• What Is CCPA? (comprehensive CCPA overview)
• California Data Privacy Laws (parent hub)
• CCPA Compliance Checklist
• CCPA Opt-Out Rights
• California Biometric Privacy Laws
• California Data Breach Notification Laws

This article provides general legal information, not legal advice. Privacy regulations evolve frequently, and enforcement interpretations change. Consult an attorney for advice specific to your situation.

More California Laws

• California Deepfake Laws
• California Employee Monitoring Laws
• California GPS Tracking Laws
• California Recording Laws

Frequently Asked Questions

Is the CPRA a separate law from the CCPA?

No. The CPRA (Proposition 24) amended the existing CCPA rather than creating a new statute. The official law is still titled the California Consumer Privacy Act of 2018. References to 'CCPA' now include all the changes the CPRA introduced, which took effect January 1, 2023.

When did the CPRA take effect?

The CPRA amendments to the CCPA took effect on January 1, 2023, and apply to personal information collected on or after January 1, 2022. The CPPA began enforcing these provisions on July 1, 2023. Additional regulations covering cybersecurity audits, risk assessments, and ADMT took effect January 1, 2026.

What new rights did the CPRA give consumers?

The CPRA added the right to correct inaccurate personal information and the right to limit a business's use of sensitive personal information. It also expanded the existing opt-out right to cover 'sharing' for cross-context behavioral advertising, not just 'sale' of personal information.

What is the California Privacy Protection Agency (CPPA)?

The CPPA is a state agency created by the CPRA to implement, interpret, and enforce the CCPA. It is the first government agency in the U.S. dedicated exclusively to consumer privacy. The CPPA shares enforcement authority with the California Attorney General and has primary rulemaking power for CCPA regulations.

Do businesses still get a 30-day cure period for violations?

It depends on who is bringing the claim. The CPRA eliminated the 30-day cure period for government enforcement, so the Attorney General and the CPPA can act and impose fines without first giving the business a chance to fix the problem. A 30-day cure period still applies to private lawsuits: under Civ. Code Sec. 1798.150(b), a consumer suing for statutory damages after a data breach must give the business 30 days' written notice first, and if the business cures within that window and confirms it in writing, the statutory damages claim cannot proceed.

What are opt-out preference signals under the CPRA?

Opt-out preference signals are browser-based settings (like Global Privacy Control) that automatically communicate a consumer's choice to opt out of the sale and sharing of their personal information. Businesses must treat these signals as valid opt-out requests, just like a consumer clicking the 'Do Not Sell or Share' link.

What is the difference between a service provider and a contractor under the CCPA?

Both are entities that process personal information on behalf of a business under a written contract. The key difference is in the contractual relationship: contractors must certify they understand and will comply with CCPA restrictions. Both are prohibited from selling or sharing the data and must assist with consumer rights requests.

Are cybersecurity audits now required under the CCPA?

Yes, for certain businesses. Regulations finalized in September 2025 (effective January 1, 2026) require businesses whose processing presents significant risk to consumer privacy to conduct annual cybersecurity audits and submit attestations to the CPPA by April 1, 2028.