CPRA Compliance
California Privacy Rights Act — California’s Comprehensive Consumer Privacy Law
lbttechgroup.com · +1 (916) 333-1062 · Sacramento, California · Veteran-Owned
WHAT IS THE CPRA?
CPRA went into effect January 2023. California businesses that collect personal data must comply.
The California Privacy Rights Act (CPRA) significantly expanded and amended the California Consumer Privacy Act (CCPA), creating one of the most comprehensive consumer data privacy frameworks in the United States. Operative since January 1, 2023, the CPRA established the California Privacy Protection Agency (CPPA) as a dedicated enforcement authority, introduced new categories of sensitive personal information, and imposed stricter obligations on businesses that collect, process, and share Californians’ personal data.
For Sacramento’s small businesses in healthcare, legal, and financial services, the CPRA intersects directly with existing regulatory obligations. Data collected in the course of HIPAA, GLBA, or FTC Safeguards compliance often overlaps with CPRA-covered personal information — meaning these businesses face layered privacy obligations that must be managed together, not independently.
Jan 2023
CPRA operative date
$7,500
max penalty per intentional violation
$2,500
per unintentional violation
CPPA
dedicated CA enforcement agency
WHO MUST COMPLY
CPRA applies to for-profit businesses that meet any one of these thresholds.
Threshold
Description
Annual Gross Revenue
Over $25 million in annual gross revenues in the preceding calendar year
Data Volume
Annually buys, sells, receives, or shares the personal information of 100,000 or more consumers or households
Revenue from Data
Derives 50% or more of annual revenues from selling or sharing consumers’ personal information
Nonprofit organizations and government agencies are generally exempt — but any for-profit entity that meets one of the three thresholds and does business in California must comply, regardless of where the business is headquartered. Businesses that fall below these thresholds are not directly required to comply, but many choose to implement CPRA-aligned practices to build customer trust and prepare for threshold changes.
KEY CPRA CONSUMER RIGHTS
What California consumers can now demand from your business.
Right
What It Requires of Your Business
Right to Know
Consumers can request disclosure of what personal information is collected, the sources, the purposes, and with whom it is shared
Right to Delete
Consumers can request deletion of their personal information; businesses must also direct service providers and contractors to delete the information
Right to Correct
New under CPRA — consumers can request correction of inaccurate personal information
Right to Opt Out of Sale/Sharing
Consumers can opt out of the sale or sharing of their personal information for cross-context behavioral advertising
Right to Limit Use of Sensitive PI
New under CPRA — consumers can direct businesses to limit use of sensitive personal information to necessary purposes only
Right of Non-Discrimination
Businesses cannot discriminate against consumers who exercise their CPRA rights
Right to Data Portability
Consumers can request their personal information in a usable format to take it to another business
SENSITIVE PERSONAL INFORMATION
The CPRA’s heightened protections for sensitive data.
The CPRA created a new category of ‘sensitive personal information’ (SPI) subject to heightened protections and a new opt-out right. For businesses in healthcare, legal, and financial services, most of the data they handle will qualify:
Social Security, driver’s license, and passport numbers
Financial account, debit/credit card numbers combined with access codes
Precise geolocation data
Race, ethnic origin, religion, or union membership
Contents of mail, email, and text messages
Genetic data and biometric information
Health and medical information (intersects with HIPAA)
Information about sexual orientation or sex life
PENALTIES & ENFORCEMENT
CPPA enforcement is active, with significant penalty exposure.
MAXIMUM PENALTY FOR INTENTIONAL VIOLATIONS
$7,500 per violation
Violations involving minors’ personal information carry automatic trebled penalties. The CPPA can seek penalties for each individual consumer record affected, meaning a single incident can generate aggregate exposure in the millions.
Violation Type
Penalty
Unintentional violation
$2,500 per violation
Intentional violation
$7,500 per violation
Violation involving minor’s PI
Trebled automatically
Private right of action (data breach)
$100–$750 per consumer per incident, or actual damages if greater
CPPA enforcement authority
Civil penalties, injunctive relief, declaratory relief
CPRA & REGULATED INDUSTRIES
How CPRA interacts with your existing compliance obligations.
The CPRA does not preempt other privacy laws — it layers on top of them. For Sacramento businesses already subject to HIPAA, GLBA, or PCI-DSS, the CPRA introduces additional obligations for the personal information those frameworks don’t cover, and in some cases imposes stricter requirements in areas they do.
Healthcare Practices:
HIPAA governs PHI — but patient information that falls outside HIPAA’s scope (e.g., appointment scheduling data, website behavior) may be subject to the CPRA. Practices need both programs running in parallel.
Law Firms:
Attorney-client privileged information may qualify for a CPRA exemption, but firm website data, marketing lists, and HR data are fully in scope. Firms must assess which data is exempt and which requires CPRA compliance measures.
Financial Services:
GLBA-covered personal financial information has a partial CPRA exemption — but only for information collected and used in connection with a financial product or service. Marketing data, prospect information, and employee data fall under the CPRA regardless.
HOW LBT SUPPORTS CPRA COMPLIANCE
Data governance and privacy compliance, operationalized.
✓ Personal Information Data Mapping
Map all personal information collected, processed, shared, and stored by your business — the foundational step for building a defensible CPRA compliance program.
✓ Privacy Notice & Policy Development
Draft and maintain compliant privacy notices, including the required CPRA disclosures about categories of personal information, purposes, and consumer rights, updated annually or upon material changes.
✓ Consumer Rights Request Process
Implement a documented process for receiving, verifying, and responding to consumer rights requests within CPRA’s required response windows (45 days, extendable by 45 days with notice).
✓ Sensitive Personal Information Controls
Implement technical and organizational controls to limit the use of SPI to authorized purposes and to honor consumers’ right to limit use.
✓ Vendor Contract Review (Data Processing Agreements)
Review and update contracts with service providers and contractors to include CPRA-required data processing terms, including deletion obligations and use restrictions.
✓ CPRA + HIPAA / GLBA Intersection Management
Map which data in your environment is covered by which framework, ensuring HIPAA-exempt data is managed under the CPRA and that the two programs operate consistently rather than in conflict.
Is Your Business CPRA Ready?
Schedule a complimentary scoping consultation. LBT will assess your current compliance posture, identify gaps, and show you exactly what it takes to close them — at no cost and no obligation.
BOOK YOUR FREE CPRA ASSESSMENT →
+1 (916) 333-1062 · lbttechgroup.com · Sacramento, California
© 2026 LBT Technology Group, LLC · CPRA Compliance Services · Sacramento, CA · Confidential