ccpa_cpra_readiness v1.0.0

name: "ccpa_cpra_readiness" description: "Get a business ready for California privacy law under the CCPA as amended by the CPRA: threshold checks, consumer rights workflows with real deadlines, sensitive personal information handling, do not sell or share and Global Privacy Control duties, and service provider contract terms. Triggers on CCPA or CPRA readiness, California privacy compliance, a rights request runbook, a do not sell or share problem, GPC handling, or a California vendor contract review."

CCPA CPRA Readiness

Purpose

Run a working readiness pass for the California Consumer Privacy Act as amended by the California Privacy Rights Act, and leave behind artifacts a team can operate: a dated threshold worksheet, a current data map, rights runbooks with computed deadlines, tested opt out and signal handling, and a vendor contract gap list. This is general information and an operating method, not legal advice. Counsel reviews close calls and final policy text.

Workflow

1. Run the threshold check first. A business is covered only if it is for profit, does business in California, collects personal information and determines the purposes and means of processing, and hits at least one threshold in Civil Code 1798.140(d). Use scripts/threshold_check.py and record the inputs, the source documents, and the date. Thresholds: annual gross revenue over $26,625,000 in the preceding calendar year, effective January 1, 2025, adjusted every odd numbered year; buys, sells, or shares the personal information of 100,000 or more consumers or households a year; or derives 50 percent or more of annual revenue from selling or sharing personal information. Revenue means global revenue, not California revenue. If no threshold hits, file the worksheet and set a reassessment date. Coverage can turn on later, and an undated verbal opinion proves nothing.
2. Build or refresh the data map. One row per system or collection point: categories of personal information, sensitive categories, sources, purposes, retention, recipients and their classification, and whether the flow is a sale or sharing. Every later step reads from this map. Detail and category lists live in references/notices-and-sensitive-pi.md.
3. Fix notices from the map. Check the notice at collection under 1798.100(b) and the privacy policy under 1798.130 against the map, category by category. A notice that lists data the business does not collect, or misses data it does, fails this step. Include rights, at least two request methods for know, delete, and correct, agent rules, signal processing, and retention by category.
4. Stand up the rights workflows. Use the runbooks in references/rights-runbooks.md for know, delete, correct, opt out of sale or sharing, and limit sensitive personal information. Compute every deadline with scripts/deadline_calc.py at intake: know, delete, and correct get confirmation within 10 business days and a substantive response within 45 calendar days, with one 45 day extension if the consumer is told inside the first 45; opt out and limit get compliance as soon as feasibly possible and no later than 15 business days, with no identity verification.
5. Test opt out like a regulator would. Submit a test opt out through the Do Not Sell or Share link, through the web form, and with a browser sending Global Privacy Control. Check that ad pixels, broker syncs, affiliate transfers, and offline lists actually stop, that the site shows the consumer their signal was honored, and that third parties who received data after the request are notified. A link that exists while data keeps flowing is the most common enforcement fact pattern, seen in the Sephora settlement in 2022, which included failure to process Global Privacy Control signals.
6. Handle sensitive personal information on purpose. Tag every sensitive category from 1798.140(ae) in the data map, including precise geolocation, government IDs, account credentials, health and biometric data. Decide for each one whether use stays inside the permitted purposes in 1798.140(e). If any use sits outside, publish the Limit the Use of My Sensitive Personal Information link or the combined Your Privacy Choices link, and build the limit workflow before launch.
7. Close the contract gaps. Classify every recipient as service provider, contractor, or third party, then check each written contract against references/contract-clauses.md: no sale or sharing, purpose limit, relationship limit, combination limit, certification, monitoring right, request flow down, subprocessor control, and delete or return at the end. Legacy contracts from before 2023 usually miss the sharing and combination terms the CPRA added.
8. Score the pass and assign the gaps. Rate each area ready, partial, or missing, with the evidence seen: threshold worksheet, data map date, notice diff, one completed test request per right with its deadline log, opt out and signal test results, contract gap list. Rank gaps by consumer impact and enforcement exposure, name one owner and one date per gap, and set the next review. Review at least every 12 months, and sooner after a new product, a new data flow, or a regulation update.

Output Contract

• A readiness report with: coverage decision and the dated threshold worksheet behind it, data map summary with its last updated date, notice and policy gaps by category, rights workflow status per right with the deadline rules in force, opt out and Global Privacy Control test results with dates, sensitive personal information inventory and Limit decision, and a vendor contract gap list with owners and dates.
• The machine output of both scripts for the worked case, saved with the report so the numbers can be rerun.
• A plain statement of what was not checked, for example employee data, offline records, or a specific app, and any item flagged for counsel.
• No invented law. Every deadline, amount, and definition in the report traces to the statute, the Title 11 regulations, or a CPPA or Attorney General page, with the source named.

Operating Rules

• Treat CPRA as an amendment, not a second law. The statute is still the CCPA, the CPRA amendments took effect on January 1, 2023, and both the California Privacy Protection Agency and the Attorney General enforce it. A business cannot be made to pay both an administrative fine and a civil penalty for the same violation.
• Use current amounts. Effective January 1, 2025, fines and civil penalties run up to $2,663 per violation and $7,988 per intentional violation or a violation involving a consumer the business has actual knowledge is under 16. Breach statutory damages run $107 to $799 per consumer per incident or actual damages, whichever is greater. Recheck amounts in odd numbered years, when the CPPA adjusts them for inflation.
• Never require identity verification for opt out or limit requests, and never require account creation for an opt out. Verification belongs to know, delete, and correct, matched first against data already held, with no fee.
• Honor opt out preference signals. Under Title 11 section 7025, a valid signal such as Global Privacy Control, sent as the Sec-GPC 1 header or navigator.globalPrivacyControl, counts as an opt out request. Process it at least for that browser or device, and for the account when the consumer is signed in and can be linked. Show the consumer the signal was honored, as the 2026 regulations require.
• Apply deletion exceptions narrowly. The eight grounds in 1798.105(d) cover only the records they actually need, for as long as they need them. Split partial outcomes instead of denying a whole request under one exception.
• Wait at least 12 months before asking a consumer who opted out to opt back in to sale or sharing. For consumers known to be under 16, sale or sharing needs opt in consent first.
• Watch the January 1, 2027 items without treating them as current law: automated decision making technology rights, expanded deletion, and the browser signal duty under the Opt Me Out Act. Verify each one in the current CPPA regulations before building on it, and label it upcoming in any report until it is in force.
• Worked example, verified with the bundled scripts on a receipt date of Wednesday, October 28, 2026: a know request is confirmed by Wednesday, November 11, 2026, answered by Saturday, December 12, 2026, and with a timely extension answered by Tuesday, January 26, 2027. An opt out received the same day is complied with by Wednesday, November 18, 2026. A shop with $5,000,000 revenue that shares data on 120,000 California households is covered on the volume threshold alone.