CCPA and CPRA

What are the CCPA and CPRA?

The California Consumer Privacy Act (CCPA) gives California residents rights over their personal information. The California Privacy Rights Act (CPRA), approved by voters in November 2020, amended it, and those amendments took effect on January 1, 2023, according to the California Attorney General. Many people now say "CCPA" for the combined law.

It applies to for-profit businesses that do business in California and meet one test: annual gross revenue above a threshold, buying, selling or sharing the personal information of 100,000 or more California residents or households, or earning half or more of revenue from selling it. The revenue threshold has been $26,625,000 since January 1, 2025.

For B2B SaaS, one date matters most. The exemptions for employee data and business contacts expired on December 31, 2022. Since then, the people at your customers, prospects and vendors are covered like anyone else.

Residents can ask to know, delete and correct their data, opt out of its sale or sharing, and limit the use of sensitive personal information. The Attorney General and the California Privacy Protection Agency (CPPA) enforce the law. People can sue directly only after certain data breaches caused by poor security, for up to $750 per incident in statutory damages, per the Attorney General's summary.

Under the statute, a sale is passing personal information to a third party "for monetary or other valuable consideration." No cash has to change hands. Sharing means passing it for cross-context behavioral advertising, which is ads based on what a person does across other sites and apps, whether or not anything is paid. See selling vs sharing for more.

A business that sells or shares must treat a Global Privacy Control signal from a browser as a valid opt-out, and the CPPA says opt-outs must be honored within 15 business days.

What it looks like in a vendor's terms

A typical clause reads like this:

When we process Personal Information for you, we act as your service provider. We will not sell or share it, will not use it for any purpose other than providing the services, will not keep or use it outside our direct relationship with you, and will not combine it with data from other sources except as the law allows.

• Service provider: the role that keeps your transfer of data to the vendor from counting as a sale. See CCPA service provider.
• Not sell or share: the vendor cannot pass your data on for value or for ads.
• Direct relationship: the vendor cannot use your data for its own products or other customers.

Stripe's DPA, for example, says that as a processor Stripe will "not sell or share" personal data.

A real change we caught

Venpo flagged that Zoom now says it may sell business contact data. Since business contacts are covered by the CCPA, a change like this is about the data of people at your company and your customers.

Why it matters to you

Your vendors can create a sale. If a vendor uses your website or customer data for its own purposes, that flow may count as a sale or sharing on your side, with opt-out duties for you.

New rules are arriving in stages. Regulations effective January 1, 2026 add risk assessments, cybersecurity audits and rules on automated decision-making technology (ADMT). Per the CPPA, as of October 2026:

1. January 1, 2026: risk assessments apply to new high-risk processing, such as selling or sharing data or processing sensitive data.
2. January 1, 2027: ADMT rules apply to businesses that use it for significant decisions, such as hiring or lending.
3. April 1, 2028: first risk assessment attestations and summaries are due, and businesses that must run cybersecurity audits and earn over $100 million certify their first one.
4. April 1, 2029 and April 1, 2030: first audit certifications for businesses with $50 to $100 million and under $50 million in revenue.

Service providers must help with these assessments and audits, according to the CCPA regulations, so your vendor contracts may need new cooperation terms.

What to check

• Every vendor that receives personal information has CCPA service provider or contractor language in its DPA or terms.
• The vendor's privacy policy does not reserve a right to sell, share or use your data for ads.
• Cookies, pixels and ad tools on your website, since ad tools can turn a page visit into sharing.
• That the vendor will pass on and help with deletion and access requests.
• Whether the vendor will cooperate with risk assessments and cybersecurity audits.

How Venpo helps

Venpo watches your vendors' privacy policies, DPAs, terms and cookie policies and emails you a plain-English alert when sale, sharing or advertising language changes. The Fine Print Scan answers, for each vendor, whether it sells data or uses it for ads.