# Regulatory Standards — CCPA/CPRA Compliance

## Primary Legislation

### California Consumer Privacy Act (CCPA) — Cal. Civ. Code §1798.100-199

Originally enacted as Assembly Bill 375 (2018), effective January 1, 2020. Established the first comprehensive consumer privacy law in the United States.

### California Privacy Rights Act (CPRA) — Proposition 24

Approved by California voters on November 3, 2020. Substantially amends the CCPA effective January 1, 2023, with a lookback period to January 1, 2022.

Key amendments:
- **§1798.100(c)**: Data minimization — collection, use, retention, and sharing must be reasonably necessary and proportionate
- **§1798.100(d)**: Required data processing agreements with service providers, contractors, and third parties
- **§1798.106**: Right to correct inaccurate personal information
- **§1798.121**: Right to limit use and disclosure of sensitive personal information
- **§1798.140(ah)**: Definition of "sharing" for cross-context behavioral advertising
- **§1798.185(a)**: CPPA rulemaking authority for regulations on risk assessments, cybersecurity audits, and automated decision-making
- **§1798.199.10-199.100**: Establishment of the California Privacy Protection Agency

### CPPA Regulations — 11 CCR §7001-7102

Final regulations adopted by the CPPA:
- **§7001-7004**: Definitions and general provisions
- **§7010-7014**: Consumer rights — notices, opt-out preference signals
- **§7020-7028**: Business obligations — privacy policy, service provider/contractor agreements
- **§7025**: Opt-out preference signals (including GPC)
- **§7030-7031**: Verification of consumer requests
- **§7050-7053**: Special rules for minors
- **§7060-7062**: Non-discrimination
- **§7100-7102**: Record-keeping and metrics

## Enforcement Precedent

### In re Sephora Inc. (August 24, 2022)

California AG settlement — $1.2 million fine for:
- Failing to disclose the sale of personal information in its privacy policy
- Failing to process opt-out requests through user-enabled GPC signals
- Failing to cure violations within the 30-day notice period

Significance: First public CCPA enforcement action; established that sharing PI with analytics/advertising partners in exchange for advertising services constitutes a "sale" under CCPA.

### CPPA Enforcement Case No. 2023-01 — DoorDash Inc.

CPPA enforcement action regarding the collection and sale of consumer personal information gathered through delivery app usage, including precise geolocation data.

## Related Federal and State Laws

### California Financial Information Privacy Act (SB-1 "Shine the Light") — Cal. Civ. Code §1798.83

Requires businesses to disclose, upon request, the categories of PI shared with third parties for direct marketing purposes and the names/addresses of those third parties.

### California Online Privacy Protection Act (CalOPPA) — Cal. Bus. & Prof. Code §22575-22579

Requires operators of commercial websites or online services that collect PI of California residents to conspicuously post a privacy policy and comply with its provisions.

### Children's Online Privacy Protection Act (COPPA) — 15 U.S.C. §6501-6506

Federal law requiring parental consent for collection of PI from children under 13. CCPA/CPRA interacts with COPPA through §1798.120(c) (opt-in consent for minors under 16).

### California Delete Act (SB-362, effective January 1, 2024)

Establishes a single mechanism through which consumers can request that data brokers registered under Cal. Civ. Code §1798.99.80 delete their personal information. The California Privacy Protection Agency administers the deletion mechanism.

## CPPA Rulemaking Status

### Completed Rulemaking
- Final Regulations: Effective March 29, 2023 (initial); updated March 29, 2024
- Topics covered: consumer rights procedures, opt-out preference signals, service provider/contractor requirements, metrics

### Pending Rulemaking (as of 2025)
- Risk assessment regulations (§1798.185(a)(15))
- Cybersecurity audit regulations (§1798.185(a)(15))
- Automated decision-making technology regulations (§1798.185(a)(16))
- Insurance company regulations (§1798.185(a)(17))