Lion Cipher Lab
Does the CCPA/CPRA apply to you? Run the applicability test, inventory personal information, and build the consumer-rights workflow
- GRC / Compliance
- Intermediate
- ~90 min
- Free · no account required
Why it matters
Almost every privacy course a beginner finds teaches the GDPR, and then the first real job hands them a US company whose customers are in California, Virginia and Colorado. The CCPA as amended by the CPRA is the law most American companies actually hit first, and it works on a genuinely different model from the GDPR: opt-out rather than opt-in, no general lawful-basis requirement, and a definition of 'share' that catches the advertising pixels on a marketing site even when nobody has ever taken money for data. Getting this wrong is not academic - an over-broad 'we never sell your information'…
What you'll learn
- reading a statute citation and telling a statute apart from a regulation
- running the CCPA/CPRA applicability test against a real revenue and consumer-count profile
- looking up the current inflation-adjusted revenue threshold instead of trusting a stale number
- defining personal information, sensitive personal information, 'sale' and 'share' precisely enough to use
- seeing why ad pixels usually make 'we do not sell data' a false statement
- extending a GDPR-style RoPA into a California personal-information inventory
- mapping the six consumer rights onto an intake-to-response workflow with the 45-day and 15-business-day clocks
- drafting a notice at collection, the privacy-policy sections, and the opt-out link
- honoring Global Privacy Control as the cheap, reliable opt-out mechanism
- contrasting CCPA/CPRA against the GDPR and building a per-state matrix instead of a per-state programme
Steps in this lab
- Before anything else: what a statute is, how to read a citation, and who enforces this
- Set up the worksheet - five tabs, named now, filled as you go
- The applicability test - does it do business in California AND clear one threshold?
- The four definitions that decide everything: personal information, sensitive PI, 'sale' and 'share'
- Inventory the personal information - extend a RoPA rather than starting over
- The six consumer rights, and the clocks that make them real
- Draft the notice at collection, the privacy-policy sections and the opt-out link
- The judgment: scope the data and the contracts, not the state lines
- CCPA/CPRA versus the GDPR - the five differences that actually change your work
- The other states - build a matrix, not a second programme