CPRA did not replace the CCPA, it amended it, doubling the law's data-volume compliance threshold from 50,000 to 100,000 California consumers or households effective January 1, 2023, according to Cal. Civ. Code Section 1798.140. The amendment also created a dedicated enforcement agency, the California Privacy Protection Agency, added two new consumer rights, and removed the original law's mandatory cure period. Every business already complying with the CCPA needed to recheck its program against a substantially rewritten statute the moment CPRA's provisions took effect.
What is the basic difference between CCPA and CPRA?
CCPA is the 2018 statute that took effect January 1, 2020, giving California consumers rights to know, delete, and opt out of the sale of their personal information, enforced solely by the California Attorney General. CPRA is a 2020 ballot initiative, Proposition 24, that amended CCPA rather than replacing it, adding new rights, a new enforcement agency, and higher compliance thresholds effective January 1, 2023. The law businesses comply with today is formally still "the CCPA," just as amended by CPRA, which is why both names appear together in nearly every compliance document.
Figure 1: Effective dates and milestones separating the original CCPA from CPRA's amendments. Source: California Legislative Information, California Privacy Protection Agency, PrivacyTerms.io compilation.
The gap between CPRA's January 2023 effective date and the CPPA's July 2023 enforcement start matters in practice: businesses had a legal obligation to comply for 6 months before the agency built specifically to enforce that obligation could actually bring a case.
Who has to comply with CCPA and CPRA in 2026?
A business qualifies under CCPA as amended by CPRA if it does business in California for profit and meets at least one of three thresholds: annual gross revenue over $26,625,000 (the original $25 million figure, adjusted for inflation), buying, selling, or sharing the personal information of 100,000 or more California consumers or households a year, or deriving 50% or more of annual revenue from selling or sharing personal information. Only the middle threshold changed with CPRA. The revenue figure kept its original $25 million baseline, just with a CPI adjustment schedule added later, and the 50% revenue-share test is untouched from the original statute.
The data-volume threshold is where CPRA made its clearest compliance change. The original 2018 statute set the bar at 50,000 or more consumers, households, or devices a year, and CPRA both doubled that number to 100,000 and dropped "devices" from the count entirely, so device-level tracking alone no longer trips this threshold the way it briefly could under the original text. A business that sat just above the old 50,000 mark and below the new 100,000 mark fell out of CCPA's data-volume test the moment CPRA's amendments took effect, even though nothing about its actual data practices changed.
What new consumer rights did CPRA add?
CPRA added two rights that did not exist under the original CCPA: the right to correct inaccurate personal information a business holds, and the right to limit use and disclosure of a new data category CPRA created, sensitive personal information. Sensitive personal information covers items like Social Security numbers, precise geolocation, racial or ethnic origin, religious beliefs, health data, sexual orientation, and the contents of a consumer's mail, email, or text messages unless the business is the intended recipient.
Figure 2: How a California consumer's request routes to a CCPA-original right or a CPRA-added right. Source: Cal. Civ. Code Section 1798.100 to 1798.121, as amended by CPRA.
A third right, to opt out of certain automated decision-making technology, was written into CPRA's statutory language in 2020 but stayed dormant until the CPPA finalized its ADMT regulations on July 24, 2025, nearly 3 years later. That gap between a right existing in statute and a right actually being enforceable is easy to miss when comparing the two laws on paper alone.
How many total consumer rights do Californians have today?
The original CCPA gave consumers 6 distinct rights: to know what personal information is collected, to delete it, to opt out of its sale, to opt in before selling a minor's data, to nondiscriminatory treatment for exercising any right, and a private right of action limited to certain data breaches. CPRA's 2 additions bring the current total to 8 rights under CCPA as amended.
Figure 3: Total distinct consumer rights recognized under California's privacy statute, before and after CPRA's amendments. Source: Cal. Civ. Code Section 1798.100 to 1798.199, compiled by PrivacyTerms.io.
Two new rights out of 8 total sounds incremental, but both new rights created entirely new operational obligations, a correction workflow and a sensitive-data-use limitation mechanism, that most CCPA-only compliance programs built before 2023 never had to support. If your privacy policy still only names 6 rights, it is describing the pre-2023 law, not the one currently in force. Businesses updating that language can generate a CCPA and CPRA-ready privacy policy that covers all 8 current rights rather than the original set.
How prepared were businesses for CPRA's 2023 deadline?
Roughly 91% of companies required to comply with CCPA were still not prepared to meet its privacy-rights requirements as of June 30, 2022, according to CYTRIO's mid-2022 State of CCPA Compliance research, which studied more than 11,000 US companies with revenue from $25 million to over $5 billion across five quarterly survey waves. That figure predates CPRA's January 2023 effective date, so it reflects a compliance gap heading into a deadline that added obligations on top of a law most surveyed businesses had not yet fully met.
Figure 4: Share of surveyed CCPA-covered businesses reporting compliance readiness as of June 30, 2022, roughly 6 months before CPRA's amendments took effect. Source: CYTRIO, "Mid-2022 Research from CYTRIO Shows Most Companies Remain Exposed to CCPA and GDPR Compliance Fines" (2022).
CYTRIO is a compliance-software vendor rather than a government regulator, so treat its 91% figure as an industry estimate, not an official audit result. No comparable government-run readiness survey exists for the CPRA transition specifically, which is itself notable: the state that built the country's most active state privacy enforcement agency has never published its own measurement of how ready businesses were for the amendment that agency now enforces.
How did CPRA change enforcement and the cure period?
CPRA's most consequential enforcement change was procedural rather than substantive: it eliminated the CCPA's mandatory 30-day cure period effective January 1, 2023. Under the original 2018 statute, a business that received a notice of alleged violation had a guaranteed 30 days to fix the problem before the Attorney General could pursue a formal enforcement action. CPRA removed that guarantee, leaving cure entirely at the enforcing agency's discretion.
That single change reshaped how both the Attorney General and the newer California Privacy Protection Agency operate. The CPPA, created by CPRA and independently empowered on July 1, 2023, now shares enforcement with the Attorney General rather than the Attorney General acting alone, and neither office owes a business a warning period before bringing a case. Combined with CPRA's regulatory requirement that businesses honor automated opt-out preference signals like Global Privacy Control, and the January 1, 2023 expiration of CCPA's temporary employee and business-to-business data exemptions, most compliance programs built for the original 2018 CCPA needed a substantial rewrite, not a light edit, to match the law CPRA left in place.
Did CPRA expand the private right of action?
No. CPRA left the scope of CCPA's private right of action unchanged: it still applies only to certain data breaches involving nonencrypted, nonredacted personal information, not to general violations of the law. Statutory damages run $100 to $750 per consumer per incident under the original 2018 text, a range the CPPA has since adjusted for inflation to $107 to $799 per consumer per incident as of its most recent update. Advocates pushed to broaden the private right of action during CPRA's 2020 ballot campaign; that provision did not survive into the final measure voters approved.
How do CCPA and CPRA compare, feature by feature?
| Feature | Original CCPA (2018 to 2022) | CPRA-amended CCPA (2023 to 2026) |
|---|---|---|
| Effective date | January 1, 2020 | January 1, 2023 |
| Enforcement start | July 1, 2020 | July 1, 2023 (CPPA) |
| Enforcement body | Attorney General only | Attorney General and the CPPA |
| Data-volume threshold | 50,000 consumers, households, or devices | 100,000 consumers or households |
| Revenue threshold | $25,000,000 | $26,625,000 (inflation-adjusted) |
| Total consumer rights | 6 | 8 |
| Sensitive personal information category | Not defined | Defined, with a right to limit use |
| Mandatory cure period | 30 days | Discretionary, not guaranteed |
| Statutory damages (private right of action) | $100 to $750 per incident | $107 to $799 per incident |
| Employee and B2B data | Temporarily exempt | Fully covered since January 1, 2023 |
Source: Cal. Civ. Code Section 1798.100 to 1798.199, California Privacy Protection Agency, compiled by PrivacyTerms.io.
The Bottom Line
The 100,000-consumer threshold is the single number most businesses need to recheck first, since it decides whether CCPA applies at all, but it is one line in a substantially rewritten law. CPRA added a dedicated enforcement agency operating alongside the Attorney General, 2 new consumer rights covering correction and sensitive-data limits, the removal of a guaranteed cure period, and full coverage of employee and business-to-business data that used to sit outside the statute entirely. A privacy policy or compliance workflow still built around the original 2018 CCPA is missing roughly a quarter of the rights California consumers currently hold and describes a cure process that no longer exists as a guarantee. Given that the CPPA now brings enforcement actions without the AG-only era's guaranteed warning period, closing that gap is worth treating as a compliance priority rather than routine maintenance.
Frequently Asked Questions
What is the main difference between CCPA and CPRA? CPRA did not replace the CCPA, it amended it. The single biggest compliance change is the data-volume threshold, which CPRA doubled from 50,000 to 100,000 California consumers or households effective January 1, 2023, alongside a new enforcement agency, two new consumer rights, and the removal of the original law's mandatory 30-day cure period.
When did CPRA take effect and when did enforcement begin? CPRA's amendments took effect January 1, 2023, but the California Privacy Protection Agency did not gain independent enforcement authority until July 1, 2023, six months later. CPRA's effective date also carried a 12-month look-back, requiring businesses to honor right-to-know requests for personal information collected as far back as January 1, 2022.
What new consumer rights did CPRA add to the CCPA? CPRA added two new consumer rights beyond the original CCPA's baseline: the right to correct inaccurate personal information and the right to limit use and disclosure of sensitive personal information, a new data category CPRA created covering items like Social Security numbers, precise geolocation, and health data. A third right, to opt out of automated decision-making technology, was written into CPRA's text but was not operationalized until the CPPA finalized its ADMT rules in July 2025.
Did CPRA change CCPA's private right of action or statutory damages? No, CPRA left the scope of the private right of action unchanged, it still only covers certain data breaches, not general violations. The dollar range moved only through routine inflation adjustment, from the original 100 to 750 dollars per consumer per incident set in 2018 to 107 to 799 dollars per consumer per incident under the California Privacy Protection Agency's most recent adjustment.
Where the Numbers Come From
- California Legislative Information. "Civil Code Section 1798.140." Statutory text defining the CCPA/CPRA applicability thresholds, current 100,000-consumer and $25,000,000-revenue tests.
- Osano. "CCPA vs. CPRA: Key Differences and Compliance Tips." Comparison of effective dates, thresholds, new rights, and cure-period elimination.
- Morgan Lewis. (2022). "California Consumer Privacy Act: Employee and B2B Exemptions Expire January 1, 2023." Source for the employee and business-to-business data exemption expiration date.
- CYTRIO. (2022). "Mid-2022 Research from CYTRIO Shows Most Companies Remain Exposed to CCPA and GDPR Compliance Fines." Source for the 91% compliance-readiness figure, based on a study of more than 11,000 US companies across five quarterly survey waves.
- Lathrop GPM. (2026). "CCPA 2026: Navigating the Expanded Consumer Privacy Compliance Requirements." Source for the 2026 inflation-adjusted $26,625,000 revenue threshold.
- California Privacy Protection Agency. (2025). Board announcement confirming the CPPA's July 1, 2023 independent enforcement authority and its ongoing enforcement activity.
Note: All figures verified as of October 2026. The CYTRIO readiness figure is a single industry survey from mid-2022, not a government audit, and no comparable official readiness study has been published since; statutory thresholds and damages figures are refreshed here whenever the California Privacy Protection Agency issues a new inflation adjustment, on its regular odd-numbered-year schedule.
