CCPA/CPRA Compliance

CCPA/CPRA for Digital Advertising

California Consumer Privacy Act / California Privacy Rights Act requirements specific to digital advertising organizations

California's privacy law gives residents the right to know what data companies collect about them, delete it, and opt out of having it sold. If you do business in California and are above certain size thresholds, you must comply. Unlike GDPR, CCPA focuses more on disclosure and opt-out rights than requiring consent upfront.

About CCPA/CPRA

The CCPA, as amended by CPRA, is California's comprehensive privacy law giving residents control over their personal information. It applies to for-profit businesses that collect California residents' data and meet certain thresholds. CPRA expanded CCPA to include additional protections and created the California Privacy Protection Agency.

Governing Body: California Privacy Protection Agency (CPPA) and California Attorney General

Who Must Comply

  • • Businesses with $25M+ annual revenue
  • • Businesses handling 100,000+ California consumers' data
  • • Businesses earning 50%+ revenue from selling personal information
  • • Businesses meeting any one of these thresholds

Key Requirements

  • • Provide "Do Not Sell or Share My Personal Information" link
  • • Honor consumer requests within 45 days
  • • Disclose data collection practices in privacy policy
  • • Implement reasonable security measures
  • • Limit use of sensitive personal information
  • • Provide opt-out of automated decision-making
  • • Maintain records of consumer requests for 24 months
  • • Train employees handling consumer requests

Is your business exposed?

Digital Advertising-Specific Requirements

  • • Implement Global Privacy Control (GPC) signal recognition
  • • Honor opt-out of cross-context behavioral advertising
  • • Limit data retention to what's necessary
  • • Provide opt-out for "sharing" (not just selling)
  • • Obtain opt-in consent for minors under 16
  • • Establish data processing agreements with partners

Common Violations in Digital Advertising

  • • Ignoring Global Privacy Control signals
  • • Making opt-out difficult or confusing
  • • Continuing to sell data after opt-out
  • • Inadequate privacy policy disclosures
  • • Not honoring deletion requests fully
  • • Lacking proper vendor agreements

Penalties

Up to $2,500 per unintentional violation and $7,500 per intentional violation. Private right of action for data breaches allows $100-$750 per consumer per incident.

Compliance Action Plan

  1. 1.

    Add "Do Not Sell or Share" link to website footer

  2. 2.

    Implement Global Privacy Control (GPC) signal detection

  3. 3.

    Update privacy policy with CCPA-required disclosures

  4. 4.

    Build consumer request intake and processing workflow

  5. 5.

    Audit all data sharing relationships with advertising partners

  6. 6.

    Implement 12-month data retention limits where applicable

Is your business exposed?

Check if your company data is circulating on the dark web

Free scan • No credit card required

Privacy PolicyYour Privacy Choices