The California Consumer Privacy Act, as amended by the CPRA, gives California residents rights over personal information that covered businesses collect. Founders should do three things: check with counsel whether the law covers the company, build a way to answer requests, and publish accurate notices.
What is the CCPA now?
California's Attorney General explains that the CPRA amended the CCPA rather than creating a separate law, so the office typically calls it the CCPA, as amended. It applies to many businesses, including data brokers. Which businesses are covered depends on criteria in the statute that are not reproduced here, so ask counsel to confirm and write the answer down.
What rights do people get?
Per the Attorney General's page, consumers have these rights.
- To know what personal information a business collects, and how it is used and shared.
- To delete personal information collected from them, with some exceptions.
- To opt out of the sale or sharing of their personal information.
- To correct inaccurate personal information.
- To limit the use and disclosure of sensitive personal information.
- To non discrimination for exercising their rights.
Businesses must respond to requests and give consumers certain notices explaining their privacy practices.
What does that mean for a seed stage product?
Constructed example: a 12 person startup sells a scheduling app to individuals. It runs analytics, an email tool and an ad pixel on its marketing site. Three consequences follow.
First, you need a data map. Where does personal information go? In this case it flows to the app database, the email vendor, the analytics provider and the ad network. A request to delete cannot be honored if nobody knows the four places.
Second, the ad pixel may count as sharing. If the company discloses personal information to ad networks for cross context advertising, the right to opt out is in play. This is a topic for counsel, and the notices should match what the product really does.
Third, support needs a procedure. Someone must receive a request, verify the person, collect or delete data across systems, and respond. Decide who, and where requests are logged.
Which decisions are worth making early?
Whether to collect sensitive personal information at all. Every extra field adds notice and handling obligations. If you do not need it, do not collect it.
Whether to use third party tags. Each one is a recipient of data. A short approved list beats a growing pile.
Whether to build deletion into the architecture. Foreign keys and backups make deletion hard to retrofit. Plan for it before you have a million rows.
Where does security come in?
The Attorney General's page focuses on rights and notices rather than technical security rules, so check the statute and regulations with counsel for the security duties that apply to you. A practical baseline is knowing which systems hold personal data and what software runs there. A dependency inventory and vulnerability scan on those systems helps. Safeguard can generate SBOMs and scan dependencies, and the free browser scan at gold.safeguard.sh/scan covers up to 100 dependencies.
What to do
- Ask counsel whether the CCPA covers you and record the reasoning.
- Map personal information flows to every system and vendor.
- Publish a privacy notice that matches the map.
- Set up an intake, verification and response procedure for requests.
- Review ad and analytics tags for sale or sharing implications.
- Reduce what you collect and keep, starting with sensitive data.
Quick check
Is the CPRA a separate law from the CCPA?
No. According to the California Attorney General, the CPRA amends the CCPA, and the office usually calls the result the CCPA, as amended.
Does the CCPA only protect customers?
It protects California residents, called consumers in the law, and the Attorney General's page lists the rights. Who counts and who is covered needs confirming with counsel.
Sources
Last reviewed: 18 October 2026.
