The CPRA did not replace the CCPA. It rewrote parts of it. California's Attorney General and the California Privacy Protection Agency now refer to the law as "the CCPA, as amended": one statute, updated. That distinction matters because every obligation that existed under the original CCPA still applies unless the CPRA specifically changed it.
California voters passed Proposition 24 in November 2020, creating the California Privacy Rights Act. According to the Attorney General's CCPA page, the amendments took effect on 1 January 2023, and they became enforceable on 1 July 2023. A court challenge then held up enforcement of the agency's first regulations until the Court of Appeal ruled in February 2024. Since then, regulators have moved quickly: as of October 2026, the largest CCPA penalty is the $12.75 million General Motors agreed to pay in May 2026.
The difference in one paragraph
The CCPA (2018) gave California residents the right to know, delete and opt out of the sale of their personal information, enforced by the Attorney General alone. The CPRA (2020) amended it to add "sharing" for cross-context behavioural advertising to the opt-out, a new category of sensitive personal information with a right to limit its use, a right to correct, a dedicated regulator with its own fines, and an end to the mandatory 30-day cure period. For a website, the biggest change is that advertising pixels now fall under the opt-out even when no money changes hands.
| Feature | CCPA (original) | As amended by the CPRA |
|---|---|---|
| Consumer data threshold | 50,000 consumers, households or devices | 100,000 consumers or households (devices removed) |
| Revenue threshold | $25 million | $26.625 million from January 2025 |
| Opt-out scope | Sale of personal information | Sale and sharing of personal information |
| Sensitive data | Not defined as a separate category | Defined, with stricter use limits |
| Right to correct data | No | Yes |
| Right to limit use of sensitive data | No | Yes |
| Automated decision opt-out | No | Yes, from 1 January 2027 |
| Who enforces | Attorney General only | Attorney General and CPPA |
| 30-day cure period | Mandatory | Up to the regulator |
How the CCPA became the CCPA as amended
Who each law applies to
The original CCPA applied to for-profit businesses operating in California that met any one of three thresholds: annual gross revenue above $25 million, buying or selling personal information of 50,000 or more consumers, households or devices, or deriving 50% or more of annual revenue from selling personal information.
The CPRA changed two of those three criteria. The consumer data threshold rose from 50,000 to 100,000 consumers or households, and the word "devices" was dropped entirely. The revenue figure, unchanged by the CPRA itself, was later adjusted for inflation to $26,625,000 from January 2025. The third criterion expanded from "selling" to "selling or sharing" personal information, which brought businesses engaged in cross-context behavioural advertising into scope even if no money changed hands.
The net effect: a handful of very small businesses fell out of scope, while a much larger group of companies running targeted advertising were pulled in.
New consumer rights under the CPRA
The CCPA gave California residents four core rights: the right to know what personal information a business collects, the right to delete that information, the right to opt out of data sales, and the right to non-discrimination for exercising those rights. The CPRA kept all four and added more.
Consumers can now request that a business correct inaccurate personal information. They can limit how a business uses their sensitive personal information. From 1 January 2027, they can opt out of automated decision-making technology (ADMT) used for significant decisions, which the regulations define as decisions about financial or lending services, housing, education, employment or compensation, and healthcare services. The CPRA also extended the right to know to data that a business shares, not only data it sells.
The right to opt out itself was broadened significantly. Under the original CCPA, consumers could only opt out of the sale of their personal information. The CPRA extended this to sharing, defined as making personal information available to a third party for cross-context behavioural advertising, regardless of whether money is exchanged. If your website loads a third-party tracking pixel that profiles visitors across multiple sites, that counts as sharing.
Sensitive personal information: a category that did not exist before
The CCPA had one broad definition of "personal information". The CPRA carved out a new subcategory called sensitive personal information (SPI), subject to stricter rules. SPI includes social security numbers, driver's licence numbers, financial account credentials, precise geolocation, racial or ethnic origin, religious beliefs, contents of private communications, genetic data, biometric data, health information, and data about sexual orientation.
Consumers can direct a business to limit its use of SPI to purposes that are necessary for providing the goods or services they requested. In practical terms, a business that uses SPI beyond those purposes must display a "Limit the Use of My Sensitive Personal Information" link alongside the existing "Do Not Sell or Share My Personal Information" link.
The California Privacy Protection Agency
Before the CPRA, only the California Attorney General could enforce the CCPA. The CPRA created the California Privacy Protection Agency (CPPA), the first dedicated data protection authority in the United States, which now calls itself CalPrivacy. The CPPA has rulemaking power, can conduct audits, and can impose administrative fines directly after formal proceedings.
The agency has been active. In 2025, the CPPA issued a $1.35 million fine against Tractor Supply Company for privacy notice and opt-out failures, a $632,500 fine against American Honda Motor Co., and a $345,178 fine against the clothing retailer Todd Snyder for an opt-out mechanism that did not work for 40 days. In March 2026 it fined PlayOn Sports $1.1 million and Ford $375,703. The CPPA also launched a data broker enforcement strike force in November 2025, bringing multiple actions against data brokers under California's Delete Act, and its Delete Request and Opt-out Platform (DROP) for data broker deletions went live in January 2026.
The Attorney General's office has pursued its own cases. The $1.55 million Healthline Media settlement in July 2025 was the largest CCPA penalty when it was announced. It involved an investigation that examined actual cookie deployment, pixel firing and data flows to advertising partners. Larger settlements followed, according to the Attorney General's list of privacy enforcement actions: Disney paid $2.75 million in February 2026, and General Motors $12.75 million in May 2026.
The 30-day cure period is gone
Under the original CCPA, businesses received a mandatory 30-day window to fix violations before regulators could pursue penalties. The CPRA removed this guarantee. Regulators now have discretion over whether to offer a cure period at all.
What "sharing" means for cookies and tracking
The CPRA's expanded definition of "sharing" is where cookies, pixels and tracking scripts become directly relevant. Sharing is making a consumer's personal information available to a third party for cross-context behavioural advertising, whether or not any money is involved.
Advertising tools such as the Meta Pixel send visitor data to companies that use it for advertising across many sites, and that usually qualifies as sharing. Analytics run by a provider acting as your service provider, under a contract that limits what it may do with the data, usually does not. Where sharing happens, your site must offer consumers a way to opt out, usually through a "Do Not Sell or Share My Personal Information" link, and must honour opt-out preference signals such as Global Privacy Control (GPC).
Unlike the GDPR, the CCPA does not require opt-in consent before setting cookies, with one exception: selling or sharing the data of consumers the business knows are under 16 needs opt-in consent, and children under 13 need a parent's consent. The model is opt-out. You can set cookies when a visitor arrives, but you must clearly disclose what data you collect, explain how it is used, identify the categories of third parties receiving it, and provide a working way for the visitor to say no.
Global Privacy Control is mandatory
GPC is a browser-level signal that communicates a consumer's preference not to have their data sold or shared. California regulators treat it as a valid opt-out request under the CCPA. The 2022 Sephora enforcement action ($1.2 million settlement) established the precedent, and several later cases, Tractor Supply and PlayOn Sports among them, also turned on opt-out signals that were not honoured.
In September 2025, the CPPA and the Attorneys General of California, Colorado and Connecticut announced a coordinated sweep of businesses that may not be honouring GPC signals. California also passed the Opt Me Out Act (AB 566) in October 2025, which requires browsers to offer an opt-out preference signal setting from January 2027.
The regulations in force from 1 January 2026 go further: a business must show whether it has processed an opt-out preference signal. The regulations give an example: displaying "Opt-Out Request Honored" on the website and showing, through a toggle or radio button in the consumer's privacy settings, that they have opted out of sale and sharing.
Updated fines and penalties
Penalty amounts are adjusted every two years based on the Consumer Price Index. The CPPA's adjustment of December 2024 set the figures that apply from 1 January 2025 until the next adjustment, due in January 2027:
| Violation type | Fine per violation |
|---|---|
| Standard violation | Up to $2,663 |
| Intentional | Up to $7,988 |
| Involving known minors (under 16) | Up to $7,988 |
| Consumer damages (data breach) | $107 to $799 per consumer per incident |
Regulators have counted violations per consumer affected, so exposure grows with traffic. A failure that affects tens of thousands of California visitors has a theoretical maximum in the hundreds of millions of dollars, even though published settlements have been far smaller: Healthline settled for $1.55 million, and the record, General Motors, for $12.75 million.
New regulations taking effect from 2026
The CPPA board adopted a major package of regulations in July 2025, and the Office of Administrative Law approved it in September 2025, as the CPPA announced on 23 September 2025. The package took effect on 1 January 2026, with some duties phased in later:
Effective 1 January 2026: businesses must show consumers whether their opt-out was processed, including opt-outs sent by GPC. Mobile apps must include a link to the privacy policy in their settings menu, which used to be optional. A new example in the rules on consent methods says that closing or navigating away from a consent pop-up without selecting the equivalent of "I accept" is not consent, and that a consumer's silence is not consent either. Privacy policies must now also list the categories of personal information disclosed to service providers and contractors.
Effective later (phased by revenue): cybersecurity audit certifications are due by 1 April 2028 for businesses earning over $100 million, 1 April 2029 for those between $50 million and $100 million, and 1 April 2030 for those below $50 million. Risk assessments are required for new processing from 1 January 2026, for processing that began earlier by 31 December 2027, and the first attestations and summaries go to the CPPA by 1 April 2028.
Automated decision-making technology (ADMT): the final rules cover technology that replaces or substantially replaces human decision-making for significant decisions, from 1 January 2027. The definition of a significant decision states that it "does not include advertising to a consumer", a notable change from earlier drafts that would have captured behavioural advertising.
How the CCPA differs from the GDPR for cookies
If your website serves visitors from both California and the EU, the consent models are fundamentally different. The GDPR, together with Article 5(3) of the ePrivacy Directive, requires prior, informed, opt-in consent before setting non-essential cookies. The CCPA allows cookies to be set immediately but requires disclosure, an opt-out mechanism and the ability to honour preference signals like GPC.
Running one consent banner for both regimes is possible but requires geo-detection. European visitors need an opt-in banner that blocks non-essential cookies until consent is given. Californian visitors need clear information about data collection, a "Do Not Sell or Share" link and a mechanism that stops third-party data sharing when triggered. A consent management platform that detects visitor location can show each group the experience you set for it. Kukie.io's geo-detection feature applies the banner rules you define for each region, based on where the visitor is browsing from.
Practical steps for websites under the amended CCPA
The starting point is knowing exactly which cookies and tracking scripts run on your site. Many businesses discover third-party cookies they did not deliberately place: leftover tags from former analytics tools, embedded widgets or advertising partners added by a previous developer. A thorough cookie scan identifies every cookie, its source, its purpose and its expiry.
Update your privacy policy
Your privacy policy must disclose the categories of personal information collected, the purposes for collection, whether information is sold or shared, and the categories of third parties receiving it. The CPRA added a requirement to identify sensitive personal information separately and explain how consumers can limit its use.
Implement opt-out mechanisms
Display a "Do Not Sell or Share My Personal Information" link prominently on your website. If you use sensitive personal information for purposes beyond those the regulations allow, add a "Limit the Use of My Sensitive Personal Information" link as well. Both links must lead to working mechanisms: the Todd Snyder enforcement action ended in a $345,178 fine partly because opt-out requests went unprocessed for 40 days.
Honour GPC signals
Configure your consent management platform to detect the Sec-GPC HTTP header or the navigator.globalPrivacyControl property and treat either as a valid opt-out. When a visitor's browser sends a GPC signal, third-party cookies involved in data sharing for advertising must be suppressed. From 2026, you must also show whether the signal was processed.
Audit your vendor contracts
The Healthline settlement highlighted contract compliance as a priority for regulators. Every agreement with a third party that receives personal information must contain CCPA-required terms specifying the limited purposes for which the data can be used. Do not assume vendors have signed the right framework: verify it.
Scan and categorise your cookies
If you do not know which cookies your site sets, you cannot disclose them accurately or suppress the right ones when a visitor opts out. Run a scan to identify every first-party and third-party cookie, categorise them by purpose and map which ones involve data sharing with external parties.
Quick answers on the CCPA and CPRA
Does the CPRA replace the CCPA?
No. The CPRA amends the CCPA rather than replacing it. California regulators refer to the combined law as "the CCPA, as amended by the CPRA". All original CCPA provisions remain in effect unless the CPRA specifically changed them.
Do I need opt-in cookie consent under the CCPA or CPRA?
Not for most visitors. The CCPA uses an opt-out model, so you can set cookies when someone visits your site. You must disclose what data you collect, provide a clear opt-out for selling or sharing, and honour Global Privacy Control signals. Opt-in consent is required only to sell or share the data of consumers you know are under 16.
What is the difference between selling and sharing personal information?
Selling involves disclosing personal information to a third party for money or other valuable consideration. Sharing involves making personal information available for cross-context behavioural advertising, even without payment. The CPRA added "sharing" to close a loophole where companies claimed they were not "selling" data when they let advertising partners access it.
What happens if my website does not honour GPC signals?
Failure to honour GPC is treated as a failure to process a valid opt-out request under the CCPA. Regulators have penalised it, starting with a $1.2 million settlement with Sephora in 2022, and opt-out signals were among the failures in the Tractor Supply ($1.35 million, 2025) and PlayOn Sports ($1.1 million, 2026) fines. A coordinated multi-state sweep targeting GPC was announced in September 2025.
What are the current CCPA fines?
From 1 January 2025, fines are up to $2,663 per violation and $7,988 per intentional violation or violation involving a known minor's data. Consumer damages for data breaches range from $107 to $799 per consumer per incident. The amounts are adjusted for inflation every two years, and the next adjustment is due in January 2027.
Does the CCPA or CPRA apply to businesses outside California?
Yes. Any for-profit business that does business in California, collects personal information from California residents and meets at least one of the three thresholds must comply, wherever the business is located.
Is a cookie banner required under the CCPA or CPRA?
The law does not explicitly require a cookie banner. You must provide a "Do Not Sell or Share My Personal Information" link where you sell or share data, disclose your data practices and honour opt-out requests. A banner is a practical way to combine these, especially if you also serve visitors under the GDPR or other laws that do require one.
Give California and EU visitors the banner each one needs
If your website attracts visitors from California, the CCPA as amended by the CPRA applies to every cookie and tracker that shares data with third parties. Knowing which cookies run on your site is the first step. Kukie.io scans and categorises your cookies, and its region rules let you show Californian visitors an opt-out and European visitors an opt-in banner.
