/cloak

CCPA / CPRA Compliance Reference

Purpose: Implementation guidance for the California Consumer Privacy Act (CCPA, 2018) as amended by the California Privacy Rights Act (CPRA, 2020, fully effective Jan 2023) and the 2026 ADMT/risk-assessment regulations. Covers consumer rights automation, opt-out signal handling (GPC), Sensitive Personal Information (SPI) limitation, and the service-provider/contractor/third-party distinction that determines contractual obligations and disclosure thresholds.

Scope Boundary

• cloak ccpa: California-specific implementation (consumer rights endpoints, GPC honoring, "Do Not Sell or Share" link, SPI limit-use mechanism, service-provider contracts).
• cloak gdpr (sibling): EU regime — opt-in/lawful-basis model. CCPA is opt-out by default; do not conflate.
• cloak pii (sibling): detection. CCPA ccpa consumes a PII inventory but enforces rights/disclosure on top of it.
• cloak consent (sibling): consent-capture UI patterns. CCPA opt-out flows live here when scoped to CA users.
• cloak dpia (sibling): CCPA risk assessments (selling/sharing PI, SPI, ADMT, biometric) are formally documented in dpia; ccpa only flags when one is required.
• canon gdpr / standard compliance (elsewhere): standard checklists across regulations. ccpa produces actionable code, not audit narrative.
• crypt (elsewhere): encryption primitives backing CCPA's "reasonable security" duty. Cloak references; Crypt designs.
• canon (elsewhere): legal review of Privacy Policy clauses, MSA addenda, DPA language. Cloak emits the technical surface; Canon approves the prose.

Workflow

DISCOVER  →  identify CA-resident data subjects, SPI fields, sale/share flows,
          →  third-party tags, ADMT touchpoints

CLASSIFY  →  bucket processors as service provider | contractor | third party
          →  flag SPI categories triggering limit-use right

MAP       →  trace PI → service providers (contract-bound) vs third parties (sale/share)
          →  GPC ingress → consumer-rights state store → downstream propagation

ASSESS    →  rights coverage (know/delete/correct/opt-out/limit), GPC honoring,
          →  visible confirmation, 2026 risk-assessment triggers, ADMT readiness

REMEDIATE →  /ccpa/opt-out, /ccpa/access, /ccpa/delete, /ccpa/correct, /ccpa/limit-spi
          →  GPC header parser + visible "Opt-Out Request Honored" UI
          →  contract templates (1798.140(ag) service provider, (j) contractor)

VERIFY    →  45-day SLA timers, authorized-agent flow, minor opt-in (<16),
          →  do-not-sell link present site-wide, financial incentive disclosure

Consumer Rights (CCPA + CPRA)

Sensitive Personal Information (SPI)

Narrow-purpose exemptions (§7027(m)): perform requested service, prevent fraud/security incidents, ensure physical safety, short-term transient use, perform internal services, comply with law, verify/maintain quality. Anything else triggers the Limit-Use link.

Service Provider vs Contractor vs Third Party

Failure to bind = automatic third-party classification. Sephora ($1.2M, 2022) was the first major settlement: pixel/cookie sharing without opt-out treated as sale.

GPC (Global Privacy Control)

Twelve states require GPC honoring by Jan 1 2026 (CA, CO, CT, DE, NJ, NH, OR, MN, MT, TX implicit, others). Cloak's ccpa recipe assumes CA semantics by default; widen scope when other states apply.

2026 Regulations — ADMT, Risk Assessment, Cybersecurity Audit

Enforcement Snapshot

Notable actions: Sephora $1.2M (2022, sale without opt-out), DoorDash $375K (2024, sale to ad cooperative), Tractor Supply $1.35M (2024, GPC failure), Honda $632K (2024, dark patterns + opt-out friction).

Anti-Patterns

• Treating "Do Not Sell" as a sale-only flag — CPRA added "or Share" for cross-context behavioral ads; pixel/tag-based ad personalization is sharing even if no money changes hands.
• One-link policy footers — both "Do Not Sell or Share" and "Limit the Use of My Sensitive PI" must be present (or one combined link with both rights). Hiding either is a violation.
• Asking the user to log in to opt out — opt-out must be available without authentication; only verification of identity-tied requests (delete/access/correct) requires login.
• Honoring GPC silently — 2026 CA regs require visible confirmation. Set data-gpc="honored" and surface a banner.
• Skipping service-provider contracts — without the §1798.140(ag) contractual flow-down, the vendor is a third party and every transfer is a sale.
• Treating CCPA as GDPR-lite — opt-out vs opt-in inverts the default. Pre-checking marketing in CA is fine; pre-sharing with ad networks is not.
• 45-day SLA without queue — manual response to high-volume DSARs misses windows. Build verifiable-request intake → identity-proof → workflow with timer.
• SPI inference without limit-use link — using ZIP+name to infer ethnicity for ad targeting triggers SPI even if the source field wasn't SPI. Inference creates SPI.
• Ignoring authorized agents — CCPA allows power-of-attorney delegation; refusing agent-submitted requests is an automatic violation.

Handoff

• To Crypt: encryption design for SPI at rest/in transit (CCPA "reasonable security" defense). Required for credentials, financial, geolocation, biometric.
• To Canon: CCPA standard checklist cross-validation against ISO/IEC 27701 PIMS controls; gap matrix.
• To Canon: Privacy Policy canon review — disclose categories, purposes, retention, sale/share, SPI, rights. Tokushoho-style equivalents for CA-targeted commerce.
• To Canon[regulatory]: SOC 2 / ISO 27001 mapping for CCPA risk-assessment + cybersecurity-audit controls; evidence package.
• To Builder: Implement opt-out endpoint, GPC parser, SPI limit-use toggle, ADMT pre-use notice, deletion-propagation queue.
• To Schema: tag SPI fields with spi_category annotation; persist gpc_honored_at, opt_out_status, limit_spi_status per consumer.
• To Gateway: header-level GPC detection middleware; consent-state propagation to downstream services.