It generally applies to for-profit businesses doing business in California that meet one of these thresholds: (A) Have $25M+ in gross annual revenue; (B) Buy, sell, or share data of 100,000+ consumers or households; or (C) Derive 50% or more of annual revenue from selling or sharing consumers' personal information.

CPRA introduced this category, which includes highly private data like Social Security numbers, financial account logins, precise geolocation, racial or ethnic origin, religious beliefs, genetic data, and the contents of mail/email/text (unless you are the intended recipient).

The CPRA (Consumer Privacy Rights Act) is an amendment that significantly expanded the CCPA. It added new consumer rights (like the right to correct inaccurate data and limit the use of sensitive data), increased fines for violations involving children's data, and established a dedicated enforcement agency, the CPPA.

Often, yes. Under CPRA, "sharing" data for cross-context behavioral advertising (like using Meta Pixel or Google Ads for retargeting) is treated similarly to "selling" data. This triggers the requirement to provide a "Do Not Sell or Share My Personal Information" link.

Businesses generally have 45 days to respond to a verified consumer request (extendable by another 45 days with notice). Failure to respond or comply can lead to regulatory fines of $2,500 per accidental violation and $7,500 per intentional violation, plus potential civil litigation.