CCPA and CPRA are not two laws to comply with. The California Privacy Rights Act amended the California Consumer Privacy Act, so what applies today is the amended statute, cited to the same Civil Code sections. That matters because a business that built for the original text and stopped is not out of date wholesale; it is missing five identifiable things.
The five additions
A right to correct inaccurate personal information, which the original text did not carry. A category of sensitive personal information with a right to direct a business to limit its use beyond permitted purposes. Sharing for cross-context behavioural advertising named alongside selling, which settled the advertising pixel question rather than leaving it to argument. A duty to state the retention period, or the criteria for setting one, at or before collection. And a dedicated regulator with rulemaking and enforcement powers alongside the Attorney General.
What did not change
The core rights to know, to delete and to opt out of sale. The forty five day response period with one extension. The requirement for a conspicuously posted policy carrying the statutory disclosures. The non-discrimination rule. The verification standard. A business that built those properly under the original statute did not waste the work, which is the practical reason the amendment framing matters more than the two acronyms.
Where to read the detail
Increasingly in the regulations rather than the statute. The agency's rules set out the wording of notices, what makes a request valid, how preference signals are treated, what a symmetrical choice looks like in a consent interface and what counts as a dark pattern. Reading the Civil Code alone leaves a build compliant with the skeleton and missing most of the specifics that an enforcement action would actually turn on.
Questions people ask about ccpa and cpra
Which name should we use?
Cite the CCPA as amended, or the Civil Code sections directly. CPRA compliance is a phrase people search rather than a separate obligation.
Do the thresholds differ between the two?
The amendment changed the volume threshold, so a business that was in scope under the original wording may sit outside the current one. Check against the current figures rather than a remembered number.
Is there a private right of action?
Only in the narrow data breach circumstances the statute names, not for disclosure or request failures generally. Those are for the agency and the Attorney General.