The CPRA, the California Privacy Rights Act, is the 2020 ballot law that amended the California Consumer Privacy Act (CCPA) from 1 January 2023. It added the right to correct data, the right to limit the use of sensitive personal information, an opt-out from "sharing" for cross-context advertising, and a dedicated regulator, the California Privacy Protection Agency (CPPA). For website owners, it means a Do Not Sell or Share link, honouring Global Privacy Control signals and no dark patterns.
CPRA and CCPA: how California's privacy law evolved
California voters approved Proposition 24 in November 2020, creating the California Privacy Rights Act. The CPRA does not replace the CCPA of 2018: it amends and expands it, as the CCPA vs CPRA comparison sets out change by change. The California Attorney General's office and the California Privacy Protection Agency (CPPA, also known as CalPrivacy) both refer to the combined law as the CCPA.
The CPRA's amendments took effect on 1 January 2023. They introduced a new category of sensitive personal information, added consumer rights to correct data and limit the use of sensitive data, and, most significantly, established the CPPA as a dedicated enforcement body with its own rulemaking authority.
That last point matters more than anything else. Before the CPRA, enforcement sat entirely with the Attorney General's office, which had limited resources and competing priorities. The CPPA has a single focus: privacy. Its record since its first fine in March 2025 shows it intends to use that focus.
Does the CPRA apply to your website?
The CPRA applies to for-profit businesses that collect personal information from California residents and meet at least one of three thresholds. Since 1 January 2025, those thresholds (adjusted for inflation) are:
| Threshold | Details |
|---|---|
| Revenue | Gross annual revenue above $26.625 million (adjusted from the original $25 million) |
| Data volume | Buys, sells or shares the personal information of 100,000 or more California consumers or households per year |
| Revenue source | Derives 50% or more of annual revenue from selling or sharing personal information |
The data volume threshold was raised from 50,000 under the original CCPA to 100,000 under the CPRA. That change narrowed the scope slightly, but many mid-sized websites with California traffic still fall within at least one of these brackets, particularly the revenue threshold.
The CPRA applies regardless of where the business is physically located. A company based in London, Berlin or Sydney that serves California residents and meets the thresholds must comply.
Consumer rights under the CPRA
The CPRA grants California residents a set of rights over their personal information that goes well beyond the original CCPA. These rights directly affect how your website handles cookies, analytics and advertising scripts.
Rights carried over from the CCPA
Consumers can request to know what personal information a business has collected about them, including the categories of data, the sources, the business purpose and the third parties it has been shared with. They can request deletion of that information, subject to certain exceptions. They can opt out of the sale of their personal information.
Rights added or expanded by the CPRA
The CPRA added the right to correct inaccurate personal information. It expanded the opt-out right to cover not just the sale of data but also the sharing of personal information for cross-context behavioural advertising, a critical distinction for any website running third-party advertising pixels. It introduced the right to limit the use and disclosure of sensitive personal information, covering data such as precise geolocation, financial account details, biometric data and health information.
In 2025, the CPPA adopted final regulations on automated decision-making technology (ADMT). From 1 January 2027, businesses that use ADMT for significant decisions, such as hiring or lending decisions, must give consumers a pre-use notice, a way to opt out and access to information about how the technology was used for them.
How the CPRA treats cookies and tracking
This is where the CPRA diverges sharply from the GDPR, and where many website owners get confused.
The GDPR requires opt-in consent before placing non-essential cookies. The CPRA does not. Under the CPRA, cookies can be set without prior consent, provided the business gives consumers a clear way to opt out afterwards. The default position is: you may collect, but you must let people say no.
That opt-out framework comes with specific obligations:
- Your website must include a clearly visible link titled "Do Not Sell or Share My Personal Information"
- If you process sensitive personal information for purposes beyond what is reasonably necessary, you must also provide a "Limit the Use of My Sensitive Personal Information" link
- You must honour Global Privacy Control (GPC) signals sent by browsers, a legal requirement under the CCPA regulations
- Your opt-out mechanism must not use dark patterns: if accepting all cookies takes one click, rejecting them must not take five
The "sharing" concept is particularly important for cookies. Under the CPRA, "sharing" means making personal information available to a third party for cross-context behavioural advertising, whether or not money changes hands. If your website loads the _fbp cookie from Meta's Pixel, or shares data with Google Ads through the _gcl_au cookie, that likely counts as "sharing" under the CPRA, and your visitors must be able to opt out.
The cookie consent banner under the CPRA
The CPRA does not explicitly require a cookie consent banner. What it requires is transparency about data collection and accessible opt-out mechanisms. A well-designed cookie banner is the most practical way to deliver both.
Your banner should disclose which categories of cookies your site uses and their purposes. It should offer category-level controls so visitors can opt out of advertising cookies while keeping functional ones. It should link to your privacy policy. And it should present choices symmetrically, which the CPPA's enforcement actions have made a priority.
Symmetry in choice: the CPPA's dark pattern crackdown
In September 2024, the CPPA issued an enforcement advisory on dark patterns: user interface designs that steer consumers away from exercising their privacy rights. The Honda enforcement action in March 2025 turned that advisory into a concrete, expensive lesson.
According to the CPPA's stipulated order against Honda, its cookie management tool let consumers accept all advertising cookies again with a single "Allow All" click, but turning them off took two steps: a toggle and then a "Confirm My Choices" button. The agency found this violated the requirement for symmetry in choice under Section 7004(a)(2) of the regulations, and Honda was ordered to add a "Reject All" button to its cookie management tool.
If your cookie banner has an "Accept all" button, the safest reading of that order is a "Reject all" button of equal prominence. The CPPA's later fines turned on different failures: Todd Snyder for an opt-out portal that did not work for 40 days and for demanding identity verification before opt-outs, and Tractor Supply Company for an opt-out that did not work for GPC signals.
Global Privacy Control under the CPRA, and the Opt Me Out Act
Global Privacy Control is a browser-level signal that tells websites a visitor wants to opt out of the sale and sharing of their personal information. Brave and DuckDuckGo turn it on by default, Firefox offers it in its settings, and users of other browsers can add it with an extension.
Under the CCPA, businesses must treat a GPC signal as a valid opt-out request. This is not a suggestion: the California Attorney General confirmed it, and the CPPA has enforced it. The Sephora settlement in 2022 ($1.2 million) was partly based on the company's failure to honour GPC signals. The Honda order required Honda to apply GPC to known consumers too, that is, to signed-in users with accounts, and in February 2026 Disney paid $2.75 million partly because a GPC opt-out covered only the device in use, even when the consumer was signed in. Since 1 January 2026, businesses must also show whether they processed the signal.
In October 2025, Governor Newsom signed AB 566, the Opt Me Out Act. From January 2027, browsers must offer a setting that lets consumers send opt-out preference signals.
The practical impact could be large. GPC adoption has been limited because the most widely used browsers do not offer it. Once they must, the share of visitors arriving with an opt-out signal is likely to rise. Any website relying on third-party advertising cookies needs a consent management system that can detect and respond to GPC signals.
Kukie.io's consent management features can treat a GPC signal as an automatic opt-out in the regions where you use an opt-out model.
Enforcement: fines are getting larger and more frequent
The CPPA adjusted its fine structure on 1 January 2025 to keep pace with inflation. The current per-violation penalties are:
| Violation type | Maximum fine per violation (from 2025) |
|---|---|
| Standard violation | $2,663 |
| Intentional violation | $7,988 |
| Violation involving a known minor under 16 | $7,988 |
| Consumer private right of action (data breach) | $107 to $799 per consumer per incident |
Regulators have counted violations per consumer affected, so a single data practice applied across a large user base can result in fines reaching millions.
The CPRA also removed the 30-day cure period that existed under the original CCPA. Regulators now have discretion over whether to offer a business time to fix a violation before imposing penalties.
Recent enforcement actions
The pace of CCPA enforcement accelerated sharply in 2025. American Honda Motor Co. received a $632,500 fine in March 2025 for asymmetric cookie choices, excessive data collection during opt-out requests and missing ad-tech contracts. Todd Snyder Inc. was fined $345,178 in May 2025 for requiring consumers to verify their identity before opting out, which the regulations do not allow, and for an opt-out portal that failed for 40 days. Tractor Supply Company was fined $1.35 million in September 2025 for failing to honour GPC signals and other CCPA violations.
The California Attorney General has kept pace. In July 2025, Healthline Media LLC agreed to what was then the largest CCPA settlement, $1.55 million, over health-related advertising data. Larger ones followed, according to the Attorney General's list of enforcement actions: Disney paid $2.75 million in February 2026, and General Motors $12.75 million in May 2026.
The CPPA has also fined a series of data brokers for failing to register under the Delete Act since late 2024, and in November 2025 it launched a data broker enforcement strike force.
CPRA vs GDPR: key differences for website owners
If you serve visitors from both California and the EU, you need to understand how these two frameworks differ in their approach to cookies and consent.
| Aspect | CPRA (California) | GDPR (EU and EEA) |
|---|---|---|
| Consent model | Opt-out: cookies may be set first, consumers can refuse later | Opt-in: non-essential cookies blocked until consent is given |
| Legal basis for cookies | Notice and right to opt out | Prior consent (Article 5(3) of the ePrivacy Directive) |
| Required links | "Do Not Sell or Share My Personal Information" and "Limit the Use of My Sensitive Personal Information" | Cookie consent banner with accept and reject options |
| Browser signals | Must honour GPC as a valid opt-out | No equivalent legal requirement |
| Enforcement body | CPPA and California Attorney General | National DPAs (CNIL, Irish DPC and others) |
| Fines | Per violation ($2,663 to $7,988) | Up to 4% of global annual turnover or EUR 20 million |
| Sensitive data | Separate "sensitive personal information" category with right to limit | Article 9 "special categories" with stricter processing conditions |
A GDPR setup covers some of the groundwork, such as a cookie inventory and a banner, but not the California-specific parts: the "Do Not Sell or Share" link, GPC handling, the notice at collection and the contracts with ad-tech partners.
Running a geo-targeted consent experience is the practical solution. Show an opt-in banner to EU visitors and an opt-out banner to California visitors. Kukie.io's geo-detection applies the consent rules you set for each region, based on visitor location.
CPRA regulations: the 2023 and 2026 packages
The CPPA's first regulations under the CPRA took effect on 29 March 2023, covering opt-out preference signals, symmetry in choice and the other rules for consumer requests. Their enforcement was held up in court until the Court of Appeal ruled for the CPPA in February 2024.
The second package was adopted in July 2025 and, as the CPPA announced on 23 September 2025, took effect on 1 January 2026. It added risk assessments (from 2026, with the first summaries due on 1 April 2028), cybersecurity audits for businesses whose processing presents significant risk (first certifications due from 1 April 2028 to 2030 depending on revenue), the ADMT rules that apply from 1 January 2027, and the duty to show consumers that their opt-out was processed.
California has also expanded the definition of sensitive personal information to include neural data: information generated by measuring the activity of a consumer's central or peripheral nervous system. Companies processing data from brain-computer interfaces, neurofeedback devices or similar technologies face the stricter rules for sensitive data.
The Delete Request and Opt-out Platform (DROP), which lets consumers send one deletion request to every registered data broker, opened on 1 January 2026. Data brokers had to start processing its requests on 1 August 2026, and more than 500,000 Californians had signed up by 25 August 2026, according to the CPPA's DROP announcement. And from January 2027, browsers must offer opt-out preference signals under the Opt Me Out Act.
How to meet the CPRA's requirements: a practical checklist
Start by scanning your website for cookies. You need a complete inventory of every cookie your site sets, first-party and third-party, along with its purpose, duration and the data it collects. A cookie scan automates this step and categorises cookies for you.
Next, review your privacy policy. It must disclose the categories of personal information collected, the purposes for collection, the categories of third parties with whom data is shared, and the specific rights California consumers have under the CCPA. If you process sensitive personal information, your policy needs to address that separately.
Implement the required opt-out links. Your website needs a "Do Not Sell or Share My Personal Information" link. If applicable, add the "Limit the Use of My Sensitive Personal Information" link. Both should be accessible from every page, typically in the footer.
Set up GPC signal detection. Your consent management platform must detect the Sec-GPC HTTP header or the navigator.globalPrivacyControl JavaScript property and treat it as a valid opt-out request, then show the visitor that it was processed.
Audit your cookie banner for symmetry. If there is an "Accept all" button, there should be a "Reject all" button with equal visual weight. The number of clicks to opt out must not exceed the number of clicks to opt in.
Review your vendor contracts. Every advertising technology partner, analytics provider or data processor that receives personal information from your website needs a contract with the CCPA-required terms limiting how they can use, retain and disclose that data. The Honda order specifically cited missing ad-tech contracts.
Document everything. Keep records of your cookie scan results, privacy policy updates, consent records and consumer rights requests. The CPPA expects businesses to show what they did, not just claim it.
Common questions about the CPRA
Does the CPRA require opt-in consent for cookies?
No. The CPRA uses an opt-out model, meaning cookies can be set without prior consent. You must provide consumers with clear opt-out mechanisms, including a "Do Not Sell or Share My Personal Information" link, and honour Global Privacy Control signals from browsers. Opt-in is required only to sell or share the data of consumers you know are under 16.
What is the difference between "selling" and "sharing" personal information under the CPRA?
Selling involves disclosing personal information for money or other valuable consideration. Sharing means making personal information available to a third party for cross-context behavioural advertising, even if no money changes hands. Loading a third-party advertising pixel on your website typically qualifies as sharing.
Can a business outside California be fined under the CPRA?
Yes. The CPRA applies to any for-profit business that collects personal information from California residents and meets the revenue, data volume or revenue-source thresholds, regardless of where the business is physically located.
What is Global Privacy Control and do I have to honour it?
Global Privacy Control (GPC) is a browser signal that communicates a consumer's preference to opt out of data sales and sharing. Under the CCPA, businesses must treat GPC signals as valid opt-out requests. From January 2027, California's Opt Me Out Act requires browsers to offer a setting that sends opt-out preference signals.
How much can my business be fined for CPRA violations?
Since 1 January 2025, fines are up to $2,663 per violation and $7,988 per intentional violation or violation involving a known minor. Regulators have counted each affected consumer as a separate violation, so fines can scale rapidly. Consumers can also sue for $107 to $799 per consumer per incident in data breach cases.
Do I need a cookie banner for the CPRA?
The CPRA does not explicitly require a cookie banner. You must disclose your data collection practices and provide accessible opt-out mechanisms. A cookie banner is the most practical way to meet both requirements, and it can also serve visitors covered by other privacy laws that do require one.
What is the CPPA's position on dark patterns in cookie consent?
The CPPA treats choice symmetry as an enforcement priority. In March 2025 it fined Honda partly because accepting advertising cookies took one click while turning them off took two, and ordered Honda to add a "Reject All" button. Todd Snyder and Tractor Supply were fined for broken opt-outs and for not honouring GPC.
Keep up with California's privacy requirements
If your website collects data from California residents, the CPRA is not a future concern: enforcement is active and penalties are increasing. Start with a cookie scan to understand what your site collects, then build your consent experience around the opt-out requirements. Kukie.io finds and categorises cookies, applies the consent rules you set for each region, and can honour GPC signals as opt-outs.
