The California Privacy Rights Act — Proposition 24, passed November 2020, effective January 1, 2023 — which amended the CCPA with new rights, tighter definitions, and a dedicated enforcement agency, the CPPA.

What did the CPRA change for advertising?

It explicitly covered 'sharing' personal information for cross-context behavioral advertising, putting pixel and audience data flows in scope and requiring the 'Do Not Sell or Share' opt-out to actually stop them.

The California Privacy Protection Agency — the first US regulator dedicated solely to privacy, created by the CPRA to write regulations and enforce the CCPA regime.

Growth Marketing Glossary

CPRA (California Privacy Rights Act)

C·P·R·Anoun (law)

The CCPA's second act — new rights, a closed adtech loophole, and a dedicated enforcement agency with marketing pixels in scope.

Schematic — the amendment that extended the CCPA

Term: CPRA (California Privacy Rights Act)
Is: California Privacy Rights Act
Passed: Proposition 24, November 2020
Effective: January 1, 2023, enforced by the CPPA

Forms & parts of speech

CPRA · noun

The CCPA's expansion law.

"The CPRA turned 'we don't sell data' into the wrong question - 'sharing' for behavioral ads now counts too."

Definition in plain terms

The CPRA — California Privacy Rights Act — is the ballot measure (Proposition 24) that California voters passed in November 2020 to amend and extend the CCPA, with most provisions effective January 1, 2023. It is not a separate regime but the CCPA's second act: new consumer rights, tightened definitions aimed squarely at advertising data flows, and a dedicated regulator — the California Privacy Protection Agency (CPPA), the first US agency built solely for privacy enforcement.

The mechanics

The amendments marketers feel most: 'sharing' joined 'selling.' The original CCPA let adtech argue that passing data to ad platforms for targeting wasn't a 'sale'; the CPRA closed that argument by explicitly covering sharing for cross-context behavioral advertising, which is why the footer link now reads 'Do Not Sell or Share My Personal Information' and why RETARGETING data flows sit plainly in scope. Consumers gained the right to correct inaccurate data and new protections for a defined category of sensitive personal information (precise geolocation, health, race, religion, and more) whose use can be limited on request. Obligations grew teeth elsewhere too — data-minimization and retention-limit principles, contractual requirements flowing down to service providers, and tripled penalties for violations involving minors' data. Enforcement moved from the Attorney General's part-time attention to the CPPA, which writes regulations and brings actions — and whose early enforcement focus has included exactly the unglamorous surface marketers own: broken opt-outs, ignored Global Privacy Control signals, and pixels that keep firing after the user said stop. CPRA compliance is therefore mostly CCPA compliance done honestly (see the CCPA entry for the base regime), with 'sharing' audits of the tag manager as the marketing-specific homework.

When it matters

The CPRA matters to any marketer the CCPA touches — which is most national brands — because it converted the gray areas marketing relied on into defined obligations. It matters operationally at three points: the tag manager (every pixel passing data for behavioral targeting is a 'share' needing a working opt-out), the consent infrastructure (Global Privacy Control signals must be honored), and vendor contracts (service-provider terms are now mandatory plumbing). The discipline mirrors the CCPA's: treat privacy as a data flow to engineer, audit what actually fires after an opt-out, and watch CPPA rulemaking — the agency's regulations keep evolving the details. (General information, not legal advice.)

Worked example. An e-commerce brand passed its 2021 CCPA review by arguing its pixel data flows weren't 'sales' - no money changed hands for data, said the memo. The CPRA's arrival rewrites the homework: passing browsing data to ad platforms for cross-context behavioral advertising is now explicitly 'sharing,' and the brand's 'Do Not Sell' link, which never touched the tag manager, is a liability with a regulator attached. The rebuild is concrete - the link becomes 'Do Not Sell or Share,' opt-outs and Global Privacy Control signals now gate every advertising tag through the consent platform, sensitive-data fields get purged from audience syncs, vendor contracts gain the required service-provider terms, and retention schedules shrink to documented purposes. When a CPPA sweep letter arrives the following year, the response is a data-flow diagram instead of a scramble - the brand had finally engineered what the 2021 memo had only argued.

Failure modes to watch. Arguing pixel flows aren't 'sales' when the CPRA explicitly covers 'sharing' for behavioral ads; opt-out links that never reach the tag manager; ignoring Global Privacy Control signals the regulations require honoring; sensitive personal information flowing into audience syncs unflagged; and treating the CPPA as theoretical while its sweeps target exactly these gaps.

Synonyms & antonyms

Synonyms

CPRACalifornia Privacy Rights ActCCPA as amended

Antonyms

CCPA (original)unregulated data sharing

Origin & history

The CPRA was the second act of privacy advocate Alastair Mactaggart's campaign — after his 2018 initiative threat produced the CCPA, Proposition 24 (November 2020, 56% in favor) entrenched the regime in ballot law, added the 'sharing' definition aimed at adtech, and created the California Privacy Protection Agency, with most provisions effective January 1, 2023.

Etymology: source.

Usage trends

Search interest for this term over the last five years:

View interest-over-time on Google Trends →

Common questions

What is the CPRA?: The California Privacy Rights Act — Proposition 24, passed November 2020, effective January 1, 2023 — which amended the CCPA with new rights, tighter definitions, and a dedicated enforcement agency, the CPPA.
What did the CPRA change for advertising?: It explicitly covered 'sharing' personal information for cross-context behavioral advertising, putting pixel and audience data flows in scope and requiring the 'Do Not Sell or Share' opt-out to actually stop them.
What is the CPPA?: The California Privacy Protection Agency — the first US regulator dedicated solely to privacy, created by the CPRA to write regulations and enforce the CCPA regime.

Related tools & calculators

toolCAC calculator
toolLTV:CAC calculator

Resources & people to follow

referenceWikipedia — California Privacy Rights Act
referenceCalifornia Privacy Protection Agency
referenceRGM analysis — audit what actually fires after the opt-out; 'sharing' lives in the tag manager, not the legal memo

Curated, non-competitor resources verified per term.

Related training

modulePerformance marketing

Disciplines

Areas of marketing where cpra is a core concern:

Performance marketingGrowth strategy

Sources

trendsGoogle Trends — "cpra"