What is the difference between CCPA and CPRA?

The CCPA (effective January 2020) was the original California privacy law. The CPRA (effective January 2023) is a ballot initiative that amended and strengthened CCPA - adding a Right to Correct, a Sensitive Personal Information category, and creating a dedicated enforcement body, the California Privacy Protection Agency (CPPA).

When does CCPA/CPRA apply to my business?

CCPA/CPRA applies to for-profit businesses doing business in California meeting any one of: (1) $25M+ annual gross revenue in the previous calendar year; (2) buying, selling, or sharing personal information of 100,000+ California consumers or households; or (3) deriving 50%+ of annual revenue from selling or sharing personal information.

What is the maximum CCPA penalty?

CCPA allows civil penalties of up to $2,500 per unintentional violation and $7,500 per intentional violation or violation involving a minor. Per-violation penalties stack - a single campaign can produce millions in exposure.

Which US states have comprehensive privacy laws?

As of 2026, comprehensive state privacy laws are in force or coming into force in California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, New Hampshire, New Jersey, Minnesota, Maryland, Indiana, Kentucky, Rhode Island, and Tennessee - with more on the way.

What is Global Privacy Control (GPC)?

GPC is a browser-level signal that communicates a user’s opt-out preference. Under CCPA/CPRA and several state laws, businesses must treat GPC as a valid opt-out of sale or sharing.

How long do I have to respond to a CCPA DSAR?

You must confirm receipt within 10 business days and substantively respond within 45 calendar days. The response window can be extended by another 45 days when reasonably necessary with notice to the consumer.

CCPA, CPRA & US Multi-State Privacy Compliance

LatestEU AI ActMay 2026High-risk AI system classification guidance published - check your tier

CCPA, CPRA & the US Patchwork

The California Consumer Privacy Act (CCPA) took effect in January 2020 and was strengthened by the California Privacy Rights Act (CPRA) in 2023, which also created the dedicated California Privacy Protection Agency (CPPA).

Since then, 18+ US states have enacted comprehensive privacy laws — each with its own thresholds, definitions, and enforcement timelines. We map a single control framework across all of them so you don't run 18 separate programmes.

Per-Violation Penalty

$7,500

intentional or involving a minor

Per-violation penalties stack — a single campaign can produce millions in exposure.

CCPA / CPRA Applicability Thresholds

For-profit businesses doing business in California meeting any one of these thresholds are in scope:

$25M+

Annual gross revenue in the previous calendar year

100,000+

California consumers, households, or devices personal info processed

50%+

Annual revenue derived from selling or sharing personal information

Six Operational Obligations

Notice at Collection

Inform consumers of categories collected and purposes of use at or before the point of collection.

Purpose Limitation

Use personal information only for disclosed purposes — no secondary uses without further notice.

Transparency

Publish a privacy policy with annual disclosures of categories sold, shared, and disclosed.

Reasonable Security

Implement and maintain reasonable security to protect personal information — a private right of action exists for breaches.

Honor Opt-Outs

Process opt-out of sale or sharing within 15 business days; honor Global Privacy Control signals.

Sensitive PI Limits

Limit use and disclosure of sensitive personal information (SSN, geolocation, biometrics, health, immigration status…).

Consumer Rights

Right to Know — what is collected, used, shared, or sold
Right to Delete — request deletion of personal information
Right to Correct — fix inaccurate personal information (CPRA)
Right to Opt-Out of Sale or Sharing — including via Global Privacy Control
Right to Limit Use of Sensitive Personal Information
Right to Non-Discrimination for exercising privacy rights
Right to Data Portability — receive personal information in a portable format

Enforcement Landscape

CCPA — unintentional violation$2,500 per violation

CCPA — intentional or involving a minor$7,500 per violation

Sephora settlement (Cal. AG, 2022)$1.2M + injunctive relief

DoorDash settlement (Cal. AG, 2024)$375,000

Connecticut Attorney General first action (2025)$85,000

US State Privacy Laws We Cover

State	Law	Effective	Regulator
California	CCPA / CPRA	Jan 2020 / Jan 2023	CPPA + AG
Virginia	VCDPA	Jan 2023	Attorney General
Colorado	CPA	Jul 2023	Attorney General
Connecticut	CTDPA	Jul 2023	Attorney General
Utah	UCPA	Dec 2023	Attorney General
Texas	TDPSA	Jul 2024	Attorney General
Oregon	OCPA	Jul 2024	Attorney General
Montana	MTCDPA	Oct 2024	Attorney General
Delaware	DPDPA	Jan 2025	Department of Justice
Iowa	ICDPA	Jan 2025	Attorney General
New Hampshire	NHPA	Jan 2025	Attorney General
New Jersey	NJDPA	Jan 2025	Attorney General

RegulatoryBridge US Privacy

Our Six-Pillar US Privacy Programme

CCPA/CPRA Privacy Notice

Pillar 01

At-collection, opt-out, financial incentive, and contact-method-appropriate notices in plain language.

DSAR & Verifiable Consumer Requests

Pillar 02

Identity verification, request intake, fulfilment within 45-day statutory window, and CPRA records.

Global Privacy Control (GPC)

Pillar 03

Server-side and client-side GPC signal honoring across web and mobile properties.

Service Provider Contracts

Pillar 04

CPRA-compliant service provider, contractor, and third-party agreements with required restrictions.

Cookie & Tracker Inventory

Pillar 05

Audit, classify, and surface opt-out controls for cookies, SDKs, pixels, and server-to-server tracking.

Multi-State Mapping

Pillar 06

Single control framework mapped across CCPA, VCDPA, CPA, CTDPA, UCPA, TDPSA, OCPA, MCDPA and 10+ state laws.

Cover all 18+ US privacy laws in one programme

A single mapped control framework with one DSAR pipeline, one cookie consent platform, and one set of contracts — instead of 18 disjointed programmes.

Run a US Privacy Assessment View US Jurisdiction

Loading…