Solutions / By Regulation
Honor every California consumer's right to know, delete, correct, and opt out of sale or sharing — across every web property, app, and downstream system you operate.
What is CCPA & CPRA?
The California Consumer Privacy Act (CCPA), expanded by the California Privacy Rights Act (CPRA), gives California residents broad rights over their personal information — including the right to access, delete, correct, opt out of the sale or sharing of personal information, and limit the use of sensitive personal information. The California Privacy Protection Agency (CPPA) and Attorney General actively enforce the law.
Typical applicability thresholds
Key requirements
Inform consumers at or before collection what categories of PI you collect and the purposes of use, with links to your privacy policy.
Provide a clear 'Do Not Sell or Share My Personal Information' link and honor Global Privacy Control (GPC) signals automatically.
Verify identity and complete deletion or correction requests within 45 days, propagating to service providers.
Allow consumers to limit the use of sensitive personal information (precise geo, biometrics, health, etc.).
Maintain CPRA-compliant data processing agreements with vendors and contractors.
Conduct and document annual cybersecurity audits and risk assessments for high-risk processing.
Penalties & enforcement
The CPPA and California AG can impose civil penalties of up to $2,500 per violation and $7,500 per intentional violation or violation involving minors. Consumers also have a private right of action for certain data breaches with statutory damages of $100–$750 per consumer per incident.
How Clarip helps
Clarip unifies consent, data discovery, subject rights, and regulatory reporting with workflows pre-configured for CCPA & CPRA.
Quick answers to the questions privacy, legal, and engineering teams most often ask about CCPA.
For-profit businesses doing business in California that meet any of: $25M+ in annual revenue; buy, sell, or share personal information of 100,000+ California consumers or households; or derive 50%+ of annual revenue from selling or sharing personal information. Service providers and contractors handling personal information on behalf of covered businesses also have obligations.
The CPRA amends and expands the CCPA. It created the California Privacy Protection Agency, added the rights to correct and to limit the use of sensitive personal information, expanded the right to opt out to cover "sharing" for cross-context behavioral advertising, and introduced new requirements like risk assessments and cybersecurity audits.
Yes. The CPPA has confirmed that businesses must treat GPC as a valid opt-out of sale/share request from the user's browser or device. Clarip detects and processes GPC signals automatically across web properties.
Businesses must confirm receipt within 10 business days and substantively respond within 45 calendar days, with a one-time 45-day extension if needed and the consumer is notified.
Civil penalties up to $2,500 per violation, or $7,500 per intentional violation or one involving a minor. Consumers have a private right of action for certain breaches with statutory damages of $100–$750 per consumer per incident.
Clarip provides an end-to-end platform for CCPA/CPRA: cookie consent and GPC handling, a DSR portal with ID verification, automated data mapping and ROPA, vendor management with CPRA-compliant DPAs, and templated risk and cybersecurity assessments — all with audit-ready evidence.
Book a 30-minute walkthrough and a custom gap assessment against CCPArequirements — mapped to the systems and vendors you already use.