CCPA, as amended by CPRA, gives California residents the right to know, delete, correct, opt out of sale or sharing, and limit use of sensitive information. A product manager decides how the product collects data, how requests flow through it, and how opt-out signals like Global Privacy Control are honored. Legal sets the interpretation.
Does it apply to your company?
The California Attorney General says the CCPA applies to for-profit businesses that do business in California and meet any one of three tests: gross annual revenue over 25 million dollars; buying, selling or sharing personal information of 100,000 or more California residents or households; or deriving half or more of annual revenue from selling residents' personal information. Dollar thresholds can be adjusted over time, so check the current figures before relying on these.
CPRA amended the CCPA in place, so the Attorney General generally calls the whole thing "CCPA, as amended." The CPRA's added rights began on 1 January 2023.
What rights become product features?
Each right turns into a flow someone has to build or operate.
- Right to know: consumers can ask what categories and specific pieces of information you collected, from what sources, for what purposes and shared with whom. The AG's FAQ says consumers can make this request up to twice a year, free of charge. You need an export that can assemble data across systems.
- Right to delete: deletion must reach service providers too, subject to exceptions such as legal retention. Delete flows touch analytics, backups and vendor tools.
- Right to correct: a way to fix inaccurate information.
- Right to opt out of sale or sharing: including through a user-enabled global privacy control. A browser signal must be honored without a separate click.
- Right to limit sensitive information: for items such as precise geolocation, financial account data or genetic data.
- Non-discrimination: you cannot punish someone for exercising rights.
Where do product managers get tripped up?
Third-party scripts. A marketing pixel or SDK that sends identifiers to an advertising partner may count as "sharing," and the opt-out must stop it. If your site loads such scripts before consent logic runs, the flow fails.
Another trap is the identity check. A deletion request needs verification that scales with sensitivity, or you risk deleting the wrong person's data, or giving it to an impostor.
Dark patterns matter too. Burying the opt-out link or making rejection harder than acceptance invites regulator attention. Design the flow to be as easy to exercise as the original data collection.
What do you decide?
You decide the intake channel, the verification steps, the internal systems each request touches, response timelines you commit to internally, and which SDKs ship in the product. You also decide what data you stop collecting, which is the cheapest compliance win: data never collected needs no deletion flow.
You do not decide whether a data flow is a "sale" or "share" under the law, or the wording of the privacy notice. Bring legal into those.
How to check or apply this
- Make a data inventory per product surface: what you collect, why, and who receives it.
- Flag every third-party SDK and tag, and test what it sends after an opt-out.
- Verify Global Privacy Control is detected and applied automatically.
- Build request handling with an owner, a log and a verification step.
- Map deletion across processors and backups, and write down exceptions.
- Review sensitive data fields and limit their use to stated purposes.
Quick check
Does an opt-out require the user to click a link?
Not if they use a global privacy control signal. The AG lists it as a valid way to opt out of sale or sharing.
Is CPRA a separate law?
No. It amended the CCPA. The Attorney General's office usually calls it CCPA, as amended.
Sources
Last reviewed: 18 October 2026.
