California Privacy Rights Act: CPRA Compliance
What is the CPRA?
The California Privacy Rights Act (CPRA) amends, expands, and largely replaces the California Consumer Privacy Act (CCPA). It creates additional data privacy rights for consumers and responsibilities for companies’ data processing.
The CPRA has been in effect since 2023, with enforcement beginning in 2024, largely managed by the California Privacy Protection Agency (CPPA), which the law created.
Common CPRA questions and answersCOMPLIANCE
How to comply with the California data privacy law
Under the CPRA, California privacy law now regulates both sale and sharing of residents’ personal data. Consumers can also opt out of use of their data for targeted advertising or profiling, or use of automated decision-making. The CPRA also established the CPPA for enforcement.
RISKS
What are the consequences of CPRA noncompliance?
Noncompliance with the CPRA can result in enforcement actions by the California Privacy Protection Agency (CPPA) or the Attorney General. Businesses face escalating fines, depending on severity and if violations were willful or not. Consumers may also sue for statutory damages if they are victims of a data breach.
your questions answered
Contact our expert team
We’re happy to answer questions about data privacy, compliant marketing operations, and the CPRA. Usercentrics’ Consent Management Platform helps you build trust and avoid penalties. Learn more today.
- Interested in how privacy compliance benefits user experience and your marketing strategies?
- Not sure if your business is privacy-compliant in California?
- Need clarity on what your company’s compliance responsibilities are?
- Looking to partner with us?
Learn more
Frequently asked questions
In addition to the rights granted to California residents under the CCPA, with the CPRA consumers were granted these additional rights:
- Right to correct: any incomplete or inaccurate personal information that a business holds about them be corrected
- Right to limit: consumers have the right to limit the use or disclosure of their sensitive personal information
- Right to opt out: consumers have the right to opt out of the sale, sharing, or use of their personal information for profiling or targeted advertising
The California Privacy Protection Agency was created with the CPRA, and they or the Attorney General can levy civil penalties up to USD 2,663 per unintentional violation, or up to USD 7,988 per intentional violation or for violations involving minors (as of 2025). Individuals can use a private right of action to sue companies for violations related to data breach events affecting them and their personal information, and can seek statutory damages between USD 107 and USD 799 per incident.
CPRA compliance software enables companies to comply with the requirements of the CCPA and CPRA, like providing consumers with information about data processing and exercising their rights, obtain consent for the use of children’s information, and enabling consumers to opt out of the sale or sharing of their personal information, or its use for targeted advertising or profiling, or limit the use of their sensitive personal information.
A consent management platform (CMP) is a type of CPRA compliance software that can enable data privacy compliance for websites and apps. A CMP consent banner presents users with information about the cookies and other tracking technologies in use that collect personal information, and enable granular user consent choices. It also securely stores and documents consent information over time.