CCPA and CPRA compliance you can actually operate.

The California Consumer Privacy Act took effect in 2020 and gave residents of California real, enforceable control over the personal information businesses collect about them. In 2023 the California Privacy Rights Act, which voters passed as Proposition 24, amended and expanded that law. People often talk about the CCPA and the CPRA as if they were two separate statutes. They are not. The CPRA is a set of amendments folded into the CCPA, so the operative law today is the CCPA as amended. When a security team or a regulator asks about your "CCPA compliance," they mean the whole amended framework.

At its core, California privacy law does two things. It tells consumers what rights they hold over their own data, and it tells businesses what they must do to honor those rights and to be transparent about their practices. That means posting a compliant privacy notice, giving consumers working ways to exercise their rights, respecting opt-out signals, limiting how you use the most sensitive categories of data, and putting the right contract terms in place with every vendor that touches California personal information.

None of that happens by accident. A privacy policy copied from a template does not make you compliant, and neither does a "Do Not Sell" link that leads nowhere. Real compliance is an operational program: you know what data you hold, why you hold it, who you share it with, and how you would respond if a consumer or the state agency asked you to prove it. That is the program we help you build.

The law reaches for-profit businesses that collect California consumers’ personal information, do business in California, and meet at least one of three thresholds. You are in scope if you have annual gross revenue above 25 million dollars; or you buy, sell, or share the personal information of 100,000 or more California consumers or households in a year; or you derive 50 percent or more of your annual revenue from selling or sharing consumers’ personal information. Meeting any one of the three is enough.

Two points surprise people. First, you do not need an office or a single employee in California to qualify. Serving California consumers over the internet is enough to be "doing business" there, which is why so many companies far outside the state fall under the law. Second, the 100,000 threshold counts households, not just individuals, and it is easier to reach than it looks once you count website visitors, app users, and leads.

The CPRA also created rules for entities that do not meet the thresholds on their own but voluntarily certify compliance, and it carved out specific handling for employee and business-to-business data that earlier versions had exempted. If you are close to a threshold, or unsure whether your consumer counts include the right categories, that ambiguity is exactly the kind of question our assessment resolves before it becomes an enforcement problem.

California privacy law grants consumers a defined set of rights, and each one creates an obligation you have to be able to meet on demand. The right to know lets a consumer ask what personal information you collected, where it came from, why you collected it, and who you disclosed it to. The right to delete lets them ask you to erase the data you hold, and to pass that request to your service providers. The right to correct, added by the CPRA, lets them fix inaccurate information.

The rights that draw the most enforcement attention concern selling and sharing. The right to opt out of sale or sharing lets a consumer tell you to stop selling their data or sharing it for cross-context behavioral advertising. The CPRA added the right to limit the use of sensitive personal information — data such as Social Security numbers, precise geolocation, health details, race, or the contents of private messages — so a consumer can restrict you to using it only for the narrow purposes the law permits.

Two mechanics matter here. You must honor the Global Privacy Control, a browser signal that communicates an opt-out automatically, as a valid request. And you cannot retaliate: charging a higher price or degrading service because someone exercised a right is unlawful discrimination under the statute. We test whether your systems actually deliver each of these rights, not just whether your policy claims to.

Every vendor that receives California personal information from you falls into one of three roles, and the label decides your contract terms and your exposure. A service provider processes data on your behalf for a business purpose you set, under a contract that bars them from using it for their own ends. A contractor is similar — a party you make personal information available to for a business purpose, again under restrictive terms. Both are, in effect, extensions of your operation, and disclosing data to them is not treated as a sale.

A third party is anyone who is neither. When you hand data to a third party for their own use, or in exchange for value, you are very likely selling or sharing it, which triggers opt-out obligations, disclosure requirements, and the "Do Not Sell or Share My Personal Information" link. Many companies think they only use service providers, then discover during data mapping that an analytics or advertising partner is actually acting as a third party. That single misclassification is one of the most common and most costly gaps we find.

Getting these relationships right is both a contract exercise and an operational one. The written terms have to include the specific commitments the law requires, and the real data flows have to match what those contracts say. We check both, because a compliant contract over a non-compliant data flow protects no one.

The CPRA created a dedicated regulator, the California Privacy Protection Agency, which now enforces the law alongside the California Attorney General. The agency writes regulations, investigates, and can bring administrative actions with penalties per violation — and the automatic 30-day cure period that softened the original CCPA is gone, so a gap can become a finding without a grace window. Separately, consumers can sue directly when certain unencrypted personal information is exposed in a breach caused by inadequate security.

Our engagement gives you a clear read of where you actually stand and a roadmap to close the distance. You receive a data map, a documented gap assessment against the amended CCPA, an analysis of your selling and sharing activity, vendor-contract findings, and a prioritized remediation plan written in language your team can act on. We are a licensed CPA firm doing practical privacy assessment and remediation work. We do not issue legal opinions — your counsel does that — and we will tell you plainly which items belong on their desk rather than ours.

Privacy compliance is not only a legal question. It is an operational and controls question, and that is where a licensed CPA firm earns its place. We build audit-grade evidence for a living, so when we map your data and test your rights processes, we do it the way an examiner would — tracing claims to proof, not taking a policy page at its word. That discipline is exactly what stands up if the California Privacy Protection Agency ever asks you to show your work.

You get senior attention that does not fade as the engagement grows, a fixed scope you can budget around, and findings written in plain English rather than statute-speak. Because we also handle GDPR, ISO 27701, and HIPAA work, we map overlapping obligations once instead of billing you to rebuild the same data inventory for each framework. And we stay in our lane honestly: we assess and remediate, and we point the legal-opinion questions to your counsel rather than pretending they are ours to answer.