CPRA: California's privacy framework
The California Privacy Rights Act (CPRA) amended and expanded the CCPA, adding a right to limit sensitive personal information, a 'sharing' opt-out for cross-context behavioural advertising, data-minimisation and retention duties, and a dedicated regulator, the California Privacy Protection Agency. This page explains, educationally, what the CPRA changed for analytics.
What the CPRA added
Building on the CCPA, the CPRA introduced a new category of 'sensitive personal information' with a right to limit its use, a 'sharing' opt-out aimed specifically at cross-context behavioural advertising, express data-minimisation and storage-limitation principles, a right to correct inaccurate data, and the California Privacy Protection Agency (CPPA) to enforce and write regulations.
- Right to limit sensitive personal information
- 'Sharing' opt-out for cross-context advertising
- Data minimisation, retention, and correction duties
- Created the CPPA regulator
Effect on analytics and ads
For measurement, the most consequential change is the 'sharing' concept: tags that pass identifiers to third parties for cross-context behavioural advertising can require a Do Not Sell or Share path and must honour opt-out preference signals like Global Privacy Control. Retention and minimisation duties also push toward collecting and keeping only what the disclosed purpose needs — which aligns with first-party, purpose-limited measurement.
How it appears in analytics and logs
Ad or analytics tags disclosing identifiers for cross-context advertising fall under CPRA 'sharing', so a missing opt-out or honoured GPC signal is a compliance gap.
Diagnostic use case
Map your California data flows against CPRA's sharing opt-out, sensitive-data limits, and retention duties to identify analytics or ad tags that need controls.
What WebmasterID can help detect
WebmasterID's first-party model with no cross-context advertising avoids the 'sharing' activity CPRA's opt-out targets.
Common mistakes
- Treating CPRA as identical to the original CCPA.
- Ignoring the sensitive-personal-information limit right.
- Overlooking retention and minimisation obligations.
Privacy and accuracy notes
This page is educational and not legal advice. CPRA thresholds, exemptions, and CPPA regulations are detailed; consult the statute and counsel for your situation.
Related pages
- CCPA / CPRA and analytics
The CCPA (as amended by the CPRA) gives California residents rights over their personal information, including a right to opt out of its sale or sharing. For analytics, that turns on whether your tooling discloses identifiers to third parties for cross-context advertising. First-party, minimised measurement narrows the exposure. This is an educational overview, not legal advice.
- Do Not Sell or Share my personal information
Under California's CCPA as amended by the CPRA, consumers can direct a business not to sell or share their personal information, where 'sharing' specifically covers disclosure for cross-context behavioural advertising. Businesses must offer a clear opt-out and honour opt-out signals. This page explains the right and how analytics and ad tags can fall within 'sharing'.
- US state privacy laws overview
In the absence of a single federal privacy statute, several US states have enacted comprehensive consumer privacy laws with overlapping but non-identical rules. Most grant access, deletion, and correction rights and require opt-outs for targeted advertising and 'sale'. This page gives an educational overview of the common pattern and how it touches analytics.
- Privacy-first analytics
Purpose-limited first-party measurement for California.
Sources and verification notes
- California Privacy Protection AgencyRegulator created by the CPRA; regulations and guidance.
- California Legislative Information — CCPA/CPRA (Civil Code 1798.100 et seq.)Statutory text as amended by the CPRA.
Last reviewed 2026-06-24. Facts are checked against primary/official sources where available; uncertain specifics are marked “Data not yet verified” rather than guessed.