CPRA compliance is a confusing phrase because the CPRA is not a separate law you comply with. The California Privacy Rights Act amended the California Consumer Privacy Act, and what you comply with is the amended statute. That matters practically: there is one set of duties, not two, and a company that built for the original CCPA and stopped in 2020 is missing five specific things rather than needing to start again.
Sensitive personal information became its own category
The amendment created a class of sensitive personal information covering, among other things, government identifiers, financial account details with access credentials, precise geolocation, racial or ethnic origin, religious beliefs, contents of mail and messages, genetic and biometric data, and health, sex life or sexual orientation data. Where a business uses it beyond a set of permitted purposes, the consumer may direct it to limit that use, which is a second link and a second process alongside the opt-out of sale.
Correction, sharing, and retention
Three additions do most of the work. A consumer may ask a business to correct inaccurate personal information about them, which is a request type the original statute did not have. Sharing for cross-context behavioural advertising was named alongside selling, so the advertising pixel argument was settled rather than argued. And a business now has to state its retention period, or the criteria for it, at or before collection, which is why so many policies grew a retention table in that period.
There is a regulator now
The California Privacy Protection Agency exists, writes the regulations and enforces them alongside the Attorney General. The practical consequence for a small company is that the detail lives in the regulations rather than the statute: the wording of notices, what counts as a valid request, how to treat preference signals, what a symmetrical choice looks like in a consent interface. Reading the statute alone leaves you compliant with about two thirds of what applies.
Whether it reaches you at all
The thresholds are a revenue test, a volume test on personal information about California residents or households, and a test for businesses that derive most of their revenue from selling or sharing. The amendment raised the volume test, so a business that fell in under the original wording may now sit outside it. Check the current thresholds against your own numbers before spending anything, and write down the date you checked and the figures you used, because the answer changes as the business grows.
Questions people ask about cpra compliance
Is the CCPA still in force?
Yes. The CPRA amended it. When people say CPRA compliance they mean compliance with the CCPA as amended, and the citations are still to the Civil Code sections beginning 1798.
What is the biggest thing a 2020 build is missing?
Usually three: the correction right, the sensitive information limit, and the retention statement. The first two are processes, the third is a paragraph you can only write once you know your own retention.
Do we have to honour a browser opt-out signal?
If you sell or share personal information, yes. The regulations treat an opt-out preference signal as a valid request, and it arrives without any click for you to log.
Does a small business get an exemption?
There is no small business carve-out as such. There are thresholds, and a company under all of them is out of scope until it is not, which is a reason to know which threshold you are nearest.