Sign in
Start free

United States

CPRA

California Privacy Rights Act

The CPRA amends and expands the CCPA. It adds the concept of ‘sensitive personal information’, new rights around correction and limiting the use of sensitive data, and creates the California Privacy Protection Agency (CPPA) to enforce the law.

Start free
Run a free scan

At a glance

Opt-out

Region
California, USA
Status
In force since January 2023
Penalties
Up to USD 2,663 per violation and USD 7,988 per intentional violation or violation involving a consumer the business knows is under 16 (adjusted for inflation in January 2025). The California Privacy Protection Agency and the Attorney General can both enforce the law.
Who it affects
Same scope as the CCPA. The CPRA raised the data threshold from 50,000 to 100,000 consumers or households, stopped counting devices and data a business only receives, and added sharing to the 50% revenue test.

What the CPRA requires

  • Meet every CCPA requirement, as amended by the CPRA.
  • Show a “Limit the Use of My Sensitive Personal Information” link, or an allowed alternative, if you use or disclose sensitive personal information for purposes beyond those the rules permit.
  • Honour requests to correct inaccurate personal information.
  • Implement data minimisation and purpose limitation principles.
  • Sign contracts with the terms the law requires with service providers, contractors and any third party you sell or share personal information with.
  • Carry out a risk assessment before starting processing that poses a significant risk to privacy, such as selling or sharing personal information or processing sensitive personal information. Processing already running on 1 January 2026 must be assessed by 31 December 2027.

Your site’s footer

An example

  • Privacy policy
  • Terms
  • Do Not Sell or Share My Personal Information

What the banner does here

No blocking wall. A “Do Not Sell or Share My Personal Information” link on every page, and a preference centre where the visitor can opt out.

How GrantCookie covers it

  • Scheduled scans. The scanner finds the cookies and trackers your site sets, sorts them into categories and re-checks on every scheduled scan, so the banner asks about what is really there.
  • Provable records. Every choice is timestamped and stored with the banner version the visitor saw. Paid plans include consent log export.
  • Opting out later. The opt-out link and preference centre are always available, so visitors can opt out or change an earlier choice at any time.

See every feature

The consent log: each row has a timestamp in UTC, a consent ID and the visitor’s choice

This page is general guidance. It is not legal advice. Check your specific obligations with a qualified adviser.

Related regulations

All regulations

  • CCPA

    Opt-out

    California Consumer Privacy Act

    California, USA In force since January 2020

  • CPA

    Opt-out

    Colorado Privacy Act

    Colorado, USA In force since July 2023

  • CTDPA

    Opt-out

    Connecticut Data Privacy Act

    Connecticut, USA In force since July 2023, with major amendments from July 2026

Start free. No card, no sales call.

Scan your site, publish the banner, and move up a tier when you outgrow the free plan. Every plan is on the pricing page.

14-day trial on paid plans · Cancel any time · No card required to start

Start free
See every price