CCPA/CPRA: California's Privacy Framework
The CCPA (California Consumer Privacy Act), amended by CPRA (California Privacy Rights Act), gives California residents specific rights over their personal information. Applies to: businesses that collect personal information of California residents AND meet thresholds (annual revenue over $25 million, buy/sell personal information of 100,000+ consumers, or derive 50%+ revenue from selling personal information). Fines: $2,500 per unintentional violation, $7,500 per intentional violation. Private right of action for data breaches.
Personal information under CCPA: real name, alias, postal address, unique personal identifier, online identifier, IP address, email address, account name, Social Security number, driver's license number, passport number, biometric information, internet activity (browsing history, search history, interaction with websites/apps), geolocation data, professional/employment information, and education information. The definition is even broader than GDPR in some respects.
The AI governance approach: any consumer-facing application that may have California users (which is nearly all US-facing applications) should implement CCPA-compliant data handling. AI rule: 'If the application serves US consumers: implement CCPA rights by default. The cost of compliance is far lower than the cost of violations, especially with the private right of action for data breaches.'
Consumer Rights: Code Must Enable Them
Right to know (Section 1798.100): consumers can request disclosure of what personal information is collected, the sources, the business purpose, the categories of third parties it is shared with, and the specific pieces of personal information collected. AI rule: 'Generate a data inventory endpoint that returns: all categories of personal information collected about the consumer, the sources of collection, the purposes, and third parties with whom it is shared. Response within 45 days. Provide through a verifiable consumer request process.'
Right to delete (Section 1798.105): consumers can request deletion of their personal information. Exceptions: completing transactions, detecting security incidents, exercising free speech, complying with legal obligations, and internal uses aligned with consumer expectations. AI rule: 'Generate a deletion workflow: verify the consumer's identity, identify all personal information, delete from all systems (including service providers), and confirm deletion. Respect exceptions: if data must be retained for legal reasons, inform the consumer of the specific exception.'
Right to opt out of sale/sharing (Section 1798.120): consumers can direct businesses to not sell or share their personal information. CPRA expanded this to include sharing for cross-context behavioral advertising. AI rule: 'Generate a Do Not Sell or Share My Personal Information link on the homepage. When opted out: stop all data sharing with third-party advertisers, analytics platforms that profile users, and data brokers. Implement GPC (Global Privacy Control) signal detection — browsers can send an automated opt-out signal.'
When a California consumer requests deletion: you must delete from your systems AND direct your service providers to delete. If user data exists in: your database, Stripe (payment processor), Mailchimp (email), Segment (analytics), Intercom (support), and Cloudflare (CDN cache) — all six must delete. The AI must generate a deletion cascade that tracks all service providers holding the consumer's data and triggers deletion at each one.
Sensitive Personal Information Under CPRA
CPRA added special protections for sensitive personal information (SPI): Social Security numbers, financial account information, precise geolocation, racial/ethnic origin, religious beliefs, union membership, personal communications (email/text content), genetic data, biometric data, health information, and sexual orientation. Consumers have the right to limit the use of SPI to what is necessary for providing the requested service.
AI rule for SPI: 'Classify personal information as standard or sensitive. Sensitive personal information: collect only if necessary for the service. Provide a Limit the Use of My Sensitive Personal Information link. When limited: use SPI only for providing the service (not for profiling, advertising, or analytics). Generate separate consent flows for SPI collection.'
Data minimization under CPRA: businesses must limit the collection, use, retention, and sharing of personal information to what is reasonably necessary and proportionate. AI rule: 'Before the AI generates a data collection feature: evaluate whether the data is reasonably necessary for the disclosed purpose. Do not collect data speculatively. Do not retain data longer than reasonably necessary. Generate retention schedules and automated purge jobs.'
Global Privacy Control (GPC) is a browser setting that sends an automated opt-out signal (Sec-GPC: 1 header). Under CPRA, businesses must treat GPC as a valid opt-out of sale/sharing request. The AI should generate middleware that: detects the GPC header, automatically applies opt-out for that user's session, and stores the preference if the user has an account. This automates compliance for privacy-conscious users without requiring them to find the opt-out link.
Implementation Patterns for CCPA/CPRA
Verifiable consumer requests: consumers exercise their rights through verifiable requests. The business must verify the consumer's identity before fulfilling the request. AI rule: 'Generate a consumer request portal: request submission (web form, email, toll-free number), identity verification (match against existing account, or knowledge-based verification for non-account holders), request tracking (consumers can check status), and fulfillment within 45 days (extendable by 45 days with notice).'
Service provider contracts: when personal information is shared with service providers (cloud hosting, analytics, email), the contract must restrict the service provider from using the data for their own purposes. AI rule: 'Track all service providers that receive personal information. The data inventory must include: which service providers receive data, what categories of data, and for what purpose. When a consumer opts out: notify service providers to stop processing that consumer's data for non-essential purposes.'
Privacy policy requirements: the privacy policy must disclose: categories of personal information collected, purposes of collection, consumer rights, and how to exercise them. Updated at least annually. AI rule: 'Generate a privacy policy framework that dynamically reflects the actual data collection practices. When the AI generates a new data collection feature: flag that the privacy policy may need updating to disclose the new collection.'
Unlike GDPR (where only regulators can fine): CCPA Section 1798.150 gives California consumers a private right of action for data breaches involving unencrypted or non-redacted personal information. Statutory damages: $100 to $750 per consumer per incident. With millions of California users: a data breach can result in class-action damages in the hundreds of millions. This makes encryption and data security not just a compliance requirement but a direct financial risk mitigation.
CCPA/CPRA AI Rules Summary
Summary of AI rules for CCPA/CPRA-compliant consumer-facing applications.
- Right to know: data inventory endpoint. All categories, sources, purposes, third parties. 45-day response
- Right to delete: verified deletion from all systems including service providers. Exception handling
- Right to opt out: Do Not Sell/Share link on homepage. GPC signal detection. Stop third-party sharing
- Sensitive PI: separate consent, limit use to service provision, Limit Use link on homepage
- Data minimization: collect only what is necessary. Retention schedules. Automated purge jobs
- Verifiable requests: identity verification, request tracking, 45-day fulfillment window
- Service providers: track all recipients. Notify when consumer opts out. Contractual restrictions
- Privacy policy: dynamically reflects data practices. Updated annually. Flag when new collection added