← Global Privacy Laws Research Library
California Privacy Rights Act of 2020: CPRA
Prepared by Shubhank Suman · Last reviewed
Current through the CCPA as amended
- Legal character
- Voter-approved amending law
- Region
- North America
- Approved
- November 2020
- Operative amendments
- 1 January 2023
What it covers
The CPRA strengthened California's consumer privacy framework by adding or expanding:
- consumer rights
- sensitive personal information controls
- sale/sharing opt-outs
- data minimisation/purpose controls
- retention-related requirements
- contractual requirements
- accountability
- regulatory oversight
- automated decisionmaking regulation
- privacy risk assessment
- cybersecurity audit authority.
Why it matters
The CPRA created the California Privacy Protection Agency (CPPA) and transferred major regulatory/enforcement responsibilities to that agency (California Privacy Protection Agency)
The modern California framework therefore has three layers:
CCPA 2018
- CPRA 2020 amendments
- current CPPA regulations
AI, privacy and cybersecurity relevance
- AI: Very High
- Privacy: Very High
- Cyber: Very High
AI
Very High.
The current California framework addresses automated decisionmaking technology.
This is one of the strongest points of intersection between California privacy law and AI governance.
Cybersecurity
Very High.
The current regulatory framework includes annual cybersecurity-audit requirements for certain covered businesses and risk-assessment requirements (California Privacy Protection Agency)
Applicability
Coverage depends on the CCPA's statutory thresholds, definitions and exclusions.
The CPPA's current materials describe thresholds based, among other things, on:
- qualifying annual revenue
- processing/selling/sharing personal information of 100,000+ California residents/households
- deriving 50% or more of annual revenue from selling/sharing California residents' personal information.
The exact threshold should be assessed against the current statutory text rather than inferred from the 2020 ballot materials (California Privacy Protection Agency)
Current validity
CURRENT: CCPA AS AMENDED BY CPRA AND CURRENT CPPA REGULATIONS.
Read first
CCPA core rights → CPRA amendments → sensitive personal information → sale/sharing → ADMT → risk assessment → cybersecurity audit → CPPA enforcement.
Provisions / sections covered
CRITICAL CLASSIFICATION
The CPRA is not a completely separate privacy law.
The California Privacy Protection Agency expressly explains that Proposition 24, the CPRA, amended the CCPA rather than creating a separate new law. The Agency therefore ordinarily refers to the operative statute as the CCPA, as amended. The CPRA amendments became effective 1 January 2023 (California Privacy Protection Agency)
This distinction should be reflected prominently on PrivacyLawHub.
IMPORTANT RIGHTS / PROVISIONS
Section 1798.100
Concerns collection, use, disclosure and related business obligations.
Section 1798.105
Deletion rights.
Section 1798.106
Correction rights.
Sections 1798.110 / 115
Access/disclosure rights.
Section 1798.120
Right to opt out of sale.
Section 1798.121
Right to limit certain uses/disclosures of sensitive personal information.
Section 1798.140
Definitions.
Section 1798.185
CPPA rulemaking authority.
CURRENT REGULATORY DEVELOPMENT
This is particularly important for your 2026 database.
The CPPA adopted regulations in September 2025 concerning:
- CCPA updates
- cybersecurity audits
- risk assessments
- automated decisionmaking technology (ADMT)
- insurance.
Those regulations became effective \*\*1 January 2026 (California Privacy Protection Agency)
Therefore the modern California privacy page should not stop at the CPRA statutory text.
Subject-matter tags
- Sensitive data
- Erasure and deletion
- Automated decision-making
- Cross-border transfers
- Data protection officer
- Retention
- Enforcement and penalties
- AI cybersecurity
- Accountability
Subject-matter tags describe what the indexed text discusses. They are not legal conclusions.
Related instruments in this library
Document page in the Knowledge Base - full text or PDF where it is available for this record.
This library locates primary and official sources. It does not interpret the law and it is not legal advice.