CPRA
California Privacy Rights Act
An expansion of CCPA that adds stronger rights, sensitive personal information rules, and clearer sharing controls.
Quick navigation
CPRA
What it means
CPRA updates and expands CCPA. It adds the concept of sensitive personal information, strengthens correction rights, and introduces clearer controls around sharing data for cross-context behavioral advertising.
For websites, CPRA is especially relevant when advertising pixels, analytics, or identity tools share identifiers across sites, apps, or services.
California, United States
Who must comply
- You are subject to CCPA and process personal information of California residents.
- You share personal information for cross-context behavioral advertising.
- You collect sensitive personal information or use vendors that may infer sensitive traits.
CPRA
What you need to do
- Offer opt-out controls for sale or sharing of personal information where applicable.
- Explain sensitive personal information practices and limitation rights.
- Support correction, access, deletion, and opt-out requests.
- Maintain contracts and controls for service providers, contractors, and third parties.
- Treat Global Privacy Control signals appropriately when required.
Plain language
What it is not
CPRA
FAQ
How is CPRA different from CCPA?
CPRA expands CCPA with sensitive information rules, correction rights, stronger enforcement, and explicit controls for sharing data in advertising contexts.
What is cross-context behavioral advertising?
It is advertising based on activity across different businesses, websites, apps, or services rather than only the site the visitor is currently using.
Do I need a 'Do Not Sell or Share' control?
If your website sells or shares personal information as defined by California law, you should provide a clear opt-out mechanism.