The California Privacy Rights Act (CPRA) amends, expands, and largely replaces the California Consumer Privacy Act (CCPA). It creates additional data privacy rights for consumers and responsibilities for companies’ data processing.
The CPRA has been in effect since 2023, with enforcement beginning in 2024 , largely managed by the California Privacy Protection Agency (CPPA), which the law created.
Under the CPRA, California privacy law now regulates both sale and sharing of residents’ personal data. Consumers can also opt out of use of their data for targeted advertising or profiling, or use of automated decision-making. The CPRA also established the CPPA for enforcement.
Noncompliance with the CPRA can result in enforcement actions by the California Privacy Protection Agency (CPPA) or the Attorney General. Businesses face escalating fines, depending on severity and if violations were willful or not. Consumers may also sue for statutory damages if they are victims of a data breach.
Achieve and maintain compliance in all regions and industries where you do business, including the EU’s GDPR , Brazil’s LGPD , and frameworks like the IAB TCF v2.2 .
Easily integrate Usercentrics CMP with your website, app, or other platforms. Supports popular CMS and other third-party services to help drive your Privacy-Led Marketing.
Targeted features like A/B Testing and Contextual Consent enable you to improve user experience quickly. Use data insights to optimize consent rates and capture more high-quality data.
Secure customers’ rights and personal data on websites and apps and protect your business. Meet CPRA requirements.
your questions answered
We’re happy to answer questions about data privacy, compliant marketing operations, and the CPRA. Usercentrics’ Consent Management Platform helps you build trust and avoid penalties. Learn more today.
In addition to the rights granted to California residents under the CCPA, with the CPRA consumers were granted these additional rights:
The California Privacy Protection Agency was created with the CPRA, and they or the Attorney General can levy civil penalties up to USD 2,663 per unintentional violation, or up to USD 7,988 per intentional violation or for violations involving minors (as of 2025). Individuals can use a private right of action to sue companies for violations related to data breach events affecting them and their personal information, and can seek statutory damages between USD 107 and USD 799 per incident.
CPRA compliance software enables companies to comply with the requirements of the CCPA and CPRA, like providing consumers with information about data processing and exercising their rights, obtain consent for the use of children’s information, and enabling consumers to opt out of the sale or sharing of their personal information, or its use for targeted advertising or profiling, or limit the use of their sensitive personal information.
A consent management platform (CMP) is a type of CPRA compliance software that can enable data privacy compliance for websites and apps. A CMP consent banner presents users with information about the cookies and other tracking technologies in use that collect personal information, and enable granular user consent choices. It also securely stores and documents consent information over time.