The most common CCPA and CPRA mistakes are scoping too narrowly, copying a privacy policy that does not match your data, ignoring employee and business contact data, missing opt out signals, leaving vendor contracts loose, and failing to test the request process. Each is cheap to fix before a complaint arrives.
1. Assuming you are too small
The law has three thresholds: revenue above $25 million, 100,000 or more consumers or households, or 50 percent of revenue from selling or sharing data. Teams read only the revenue test. The second threshold counts households and counts data you buy or share, so a modest company with a large audience can be covered. Test all three and write down the result.
2. Forgetting employees and business contacts
The employee and business to business exemptions expired on December 31, 2022. HR systems, recruiting tools and CRM records of contacts at other companies are in scope. If your notice at collection exists only on the consumer website, applicants and staff are not covered by it.
3. Copying a policy from another company
A privacy policy that lists data you do not collect, or omits data you do, is a statement you can be held to. Build the policy from your data map. Section 1798.100 requires telling people the categories, purposes and retention at or before collection. If you cannot state a retention period, state the criteria you use.
4. Treating "we do not sell data" as the end of the question
The law also covers "sharing" for cross context behavioral advertising. Advertising tags, pixels and SDKs often send data to third parties without a deliberate business decision. Ask marketing and engineering to list every tag, then decide whether each disclosure is a sale or share.
5. Ignoring the global privacy control
The Attorney General's page notes that consumers can opt out through a user enabled global privacy control such as GPC. If your site keeps firing advertising tags after the signal arrives, your opt out process has a hole. Test it in a browser with the signal on and keep a dated record.
6. Making opt out harder than opt in
Opt out requests cannot require an account, and the "Do Not Sell or Share" link must be clear and conspicuous. A business should also wait at least 12 months before asking someone who opted out to opt back in. Flows that bury the link or demand a login fail the intent of the rule.
7. Weak vendor contracts
A written contract that limits a service provider to the contracted purpose is what separates a service provider from a third party. First timers sign vendor paper without reading the data terms. Review every contract that touches personal information, and add terms where they are missing.
8. No tested request process
Requests to know, delete and correct need an answer within 45 calendar days, extendable once by another 45 days with notice. Opt outs must be honored no later than 15 business days after receipt. Without a log, owner and deadline timer, requests sit in a shared inbox. Run a mock request and time it. Check what deletion means for backups, data warehouses and logs.
9. Missing the security side
Private lawsuits are allowed for certain data breaches of specific unencrypted and unredacted personal information caused by a failure to maintain reasonable security, with statutory damages up to $750 per consumer per incident (the statute adjusts the amounts). Encryption, access control and patching are part of privacy here, not a separate project.
What does the penalty picture look like?
Administrative enforcement by the California Privacy Protection Agency or the Attorney General can bring fines of up to $2,500 per violation, or $7,500 for each intentional violation or one involving consumers known to be under 16, as adjusted under the statute. The statute says amounts are updated, so check the current figures.
What to do
- Retest all three thresholds and date the result.
- Add HR and business contact data to your data map.
- Rebuild the privacy policy from the map, not a template.
- List every advertising and analytics tag and classify the disclosure.
- Test the opt out signal on the live site.
- Review vendor contracts and add missing use limits.
- Run a mock request and measure the time to complete it.
- Check encryption and access controls on systems with personal information.
Quick check
Is an annual review of the privacy policy required?
The Attorney General's page we read does not state a frequency, so check the statute and regulations for the current rule, and review it whenever your data practices change.
Can we make people create an account to opt out?
No. According to the Attorney General's page, opt out requests cannot require an account.
How Safeguard helps automate this
Several of these mistakes come from information that lives in code: tags, SDKs and libraries that send data out, and security controls that were assumed but never checked. Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of by screenshot, and monitoring runs between reviews. Technical evidence comes from your real code and dependencies through scans, SBOMs and reachability. The agent can open tested fix pull requests, but it is off by default, every category starts on Manual, and you decide what runs automatically. Safeguard helps prepare evidence; it does not provide legal advice or guarantee an outcome. Book a call.
Sources
Last reviewed: 18 October 2026.
