30 Days Free Trial
Skip to main content

Mandatly Knowledge Base

< All Topics

Differences Between CCPA and CPRA

The California Privacy Rights Act (CPRA) took effect on January 1, 2023, making changes to the existing California Consumer Privacy Act (CCPA). It strengthens consumer privacy rights, adds new data protections, and increases responsibilities for businesses that handle personal data. In addition, the CPRA establishes the California Privacy Protection Agency (CPPA), which will oversee implementation and compliance.

Key Differences Between CCPA and CPRA:

The CPRA builds on and updates the CCPA by refining its provisions, increasing consumer privacy protections, and imposing stricter requirements on businesses that collect personal information from California residents. It also introduces a dedicated agency, the California Privacy Protection Agency, which is responsible for implementing and enforcing these regulations.

Overview: CCPA and CPRA

Feature CCPA (California Consumer Privacy Act) CPRA (California Privacy Rights Act)
Applicability
  • Businesses with $25M+ revenue
  • Businesses processing data of 50,000+ CA residents
  • Businesses earning 50%+ revenue from data sales
  • Businesses with $25M+ revenue
  • Businesses processing data of 100,000+ CA residents
  • Businesses earning 50%+ revenue from data sales
Effective Date 1-Jul-20 1-Jul-23
Consumer Rights
  • Right to know what data is collected
  • Right to access collected data
  • Right to delete data
  • Right to data portability
  • Right to opt-out of data sale
  • Right to non-discrimination
  • All CCPA rights plus:
  • Right to correct (rectify) data
  • Right to limit use of sensitive data
Personal Information Definition Broad definition covering identifiers & linked data, excludes public &
deidentified data		 Same as CCPA
Sensitive Personal Information Categories must be disclosed to consumers Consumers can limit use and sharing of sensitive personal information
Minors’ Data Prohibits sale of personal data of minors under 16 without consent Prohibits sale or sharing of personal data of minors under 16 without
consent
Data Minimization Not explicitly required Required: limit data collection and retention
Security Measures Businesses must maintain reasonable security Same as CCPA
Privacy Notices Notice at collection, opt-out, and financial incentives required Same as CCPA, plus notice on sensitive data
Penalties
  • $2,500 per violation
  • $7,500 for intentional violations
  • $2,500 per violation
  • $7,500 for intentional violations & minors’ data violations
Common Provisions
  • 45-day response period
  • Purpose limitation
  • No discrimination
  • Right to opt-out of sale
  • 30-day period to cure allegation
  • 45-day response period
  • Purpose limitation
  • No discrimination
  • Right to opt-out of sale & sharing
  • 30-day period to cure allegation

Related Articles & Resources: