The CCPA is California's consumer privacy law. The CPRA, approved by voters in November 2020, amended it, so the correct name is "CCPA, as amended." The amendments added a right to correct data, a right to limit use of sensitive data, and a dedicated agency, the CPPA. This glossary defines the terms you will hear.
It explains the law's vocabulary from the California Attorney General's public page. It does not say your company is compliant, and no tool or vendor can certify that for you. Your privacy counsel owns that call.
Core terms
CCPA. The California Consumer Privacy Act. It gives California residents rights over personal information that businesses collect about them.
CPRA. The California Privacy Rights Act, Proposition 24. It amended the CCPA. The Attorney General says its new protections took effect on 1 January 2023 and that businesses must comply with its statutory requirements.
CPPA. The California Privacy Protection Agency. Since 1 July 2023 consumers can file complaints with it about violations on or after that date. Per the Attorney General, only the Attorney General or the CPPA can take legal action for most violations. Individuals generally cannot sue, except in certain data breach cases.
Personal information. Information about a consumer that the law covers. The Attorney General's page describes requests in terms of categories and specific pieces of it. Check the statute text for the full definition before you rely on a summary.
Business. The legal term for a company the law applies to. Whether you are one depends on thresholds in the statute, which this post does not restate. Ask counsel.
Service provider. A company that processes personal information for a business. When a consumer asks for deletion, the business must also tell its service providers to delete.
The consumer rights
Right to know. A consumer can ask for the categories and specific pieces of personal information collected, the sources, the purposes, and who it was shared with or sold to. The page says a consumer can make this request up to twice a year, free of charge.
Right to delete. Ask a business to delete information it collected from you, subject to exceptions such as legal obligations.
Right to correct. Ask for inaccurate information to be fixed. This came with the CPRA.
Right to opt out of sale or sharing. Ask the business to stop selling or sharing. This can be done through a user enabled global privacy control such as GPC. After an opt out, a business generally cannot sell or share again unless the consumer authorizes it, and it must wait at least 12 months before asking them to opt back in.
Right to limit sensitive personal information. Direct the business to use sensitive data only for limited purposes, such as providing the service requested. Also added by the CPRA.
Non-discrimination. A business cannot deny service, change prices or lower quality because someone used a right, and cannot make them waive the rights.
Sale versus sharing
These two words trip people up. The Attorney General's page defines "sharing" narrowly: sharing for cross-context behavioral advertising, which means targeting ads from a person's activity across multiple websites. It does not give a full definition of "sale" on that page, so read the statute for that one. In practice both come with the same opt out right.
What about security and audits?
The CPPA's regulations page lists a package of rules covering CCPA updates, insurance, cybersecurity audits, risk assessments and automated decisionmaking technology, adopted in September 2025. The page does not describe the requirements, so check the CPPA's detail page for scope, applicability and dates before planning around any of it.
What to do
- Ask your privacy lead for a data map: what personal information you collect, where it lives, which service providers touch it.
- Confirm you can honor each right within the response window the law sets. Look up the exact days in the statute and regulations.
- Test that your site respects a global privacy control signal.
- Separate "sale", "sharing" and "sensitive" in your records so opt outs and limits can be applied.
- Make sure deletion requests reach service providers.
- Read the CPPA's cybersecurity audit and risk assessment rules and note which apply to you.
- Keep evidence of each request and your response.
Quick check
Is the CPRA a separate law from the CCPA?
No. The CPRA amended the CCPA, so the Attorney General refers to the law as "CCPA, as amended."
Can a consumer sue a business for any CCPA violation?
Generally no. Per the Attorney General, only the Attorney General or the CPPA can take legal action for most violations, with an exception for certain data breach cases.
What does opting out of sharing cover?
Sharing for cross-context behavioral advertising, plus sale. A global privacy control can carry the request.
Sources
Last reviewed: 18 October 2026.
