CCPA and CPRA Compliance: What California Businesses Actually Have to Do

The obligations that get checked first

• A compliant privacy policy describing categories collected, purposes, sources, disclosures, retention periods, and consumer rights, reviewed at least annually.
• Notice at collection presented at or before the point of collection, including in job applicant and employee contexts.
• A Do Not Sell or Share My Personal Information link, and a Limit the Use of My Sensitive Personal Information link where applicable.
• Honoring the Global Privacy Control browser signal as a valid opt-out — a frequent enforcement theme.
• Two designated methods for submitting requests, with responses generally within 45 days.
• No discrimination against consumers who exercise their rights.

Rights you must be able to fulfill

Consumers can request to know what was collected, delete it, correct it, opt out of sale or sharing, limit use of sensitive personal information, and obtain data portability. Fulfillment requires knowing where the data actually lives, which is why a data inventory is the practical prerequisite to everything else.

Deletion requests must also flow to service providers and contractors, which only works if the contracts require it.

Vendor contracts are mandatory, not optional

The statute requires specific terms in contracts with service providers, contractors, and third parties: purpose limitation, prohibitions on retaining or using data outside the contract, an obligation to assist with consumer requests, and the right to take steps on notice of unauthorized use. Without those terms, a disclosure to a vendor can be treated as a sale.

Ad tech and analytics deserve particular attention, because sharing for cross-context behavioral advertising triggers opt-out obligations even where no money changes hands.

Employee and B2B data

The exemptions for employee and business-to-business data expired. Applicants, employees, contractors, and business contacts are consumers under the statute, which means notices at collection for HR data and a process for handling employee requests.

Exposure and how to reduce it

• Administrative penalties per violation, with a higher tier for violations involving minors, and no automatic cure period.
• A private right of action, including statutory damages, for breaches of certain unencrypted personal information caused by failure to maintain reasonable security.
• Companion exposure under the California Invasion of Privacy Act for website tracking, session recording, and chat tools — a fast-growing category of demand letters.
• Practical fixes: run a data inventory, audit the tag stack on your site, paper the vendor contracts, test your request workflow end to end, and document security measures.

Getting a review

A privacy review is a bounded project: inventory, notices, links, contracts, and workflow. Rainey Law P.C. runs CCPA and CPRA compliance reviews for California businesses and responds to privacy demand letters and inquiries.