CCPA After CPRA: California Privacy Rights in 2026

From CCPA to CPRA

The California Privacy Rights Act (CPRA), effective January 2023, amends and extends the California Consumer Privacy Act (CCPA). It introduces new consumer rights, establishes the California Privacy Protection Agency, and creates stricter rules for sensitive personal information.

California continues to lead US privacy legislation, setting the standard that other states increasingly follow.

Key Consumer Rights

Right to Correct: Consumers can request businesses to correct inaccurate personal information.

Right to Limit Use: Consumers can limit the use and disclosure of sensitive personal information.

Right to Delete: Consumers can request deletion of their personal information, with expanded scope.

Right to Know and Opt Out: Consumers can learn what a business collects and can opt out of the sale or sharing of personal information, including through a recognized Global Privacy Control signal.

Implications for Consent Management

A covered business that sells or shares personal information must provide the prescribed opt-out route and honor valid browser-based opt-out preference signals. A "Limit the Use of My Sensitive Personal Information" mechanism is relevant where sensitive information is used beyond the limited purposes allowed by the statute. The exact notices and links depend on the business's practices.

1Consent's US Privacy Module

1Consent can present US privacy choices, detect Global Privacy Control, and pass downstream signals through the IAB Global Privacy Platform. The older US Privacy String is deprecated; current implementations should use the applicable GPP national and state sections and verify that every recipient respects the signal.