CCPA / CPRA

What it is

The California Consumer Privacy Act (2018), amended by the California Privacy Rights Act (effective 2023). Grants California residents rights over their personal data, including the right to know, delete, correct, and opt out of sale or sharing.

Why it matters

The CPPA actively investigates and fines non-compliant sites. The 'Do Not Sell or Share' link and a complete privacy policy are the cheapest insurance against an enforcement action.

Who it applies to

California residents — but most sites with U.S. traffic encounter California users, so default to applying it.

• Jurisdictions: United States

How WQI scores it

Web Quality Index considers this standard satisfied when all of the 3 supporting factors pass.

0 of 3 supporting factors are currently collected. Sites where the remaining 3 haven't been measured will show as partial or unknown on this standard until the data lands.

Related standards

See also

GDPR , Cookie consent , VCDPA , CPA , CTDPA , UCPA , TDPSA , OCPA

Standards that share factors with this one

Auto-computed from overlapping factor tickets in satisfiedBy, excluding standards already listed under "See also" above. Strong overlap suggests these standards rise and fall together when sites are scored.

• Australian Privacy Act + APPs 2 shared factors Privacy Australia's federal privacy law, anchored on the 13 Australian Privacy Principles. The 2024 reforms added a statutory tort for serious privacy invasions and direct OAIC penalty powers.
• COPPA 2 shared factors Privacy If your site is directed at U.S. children under 13 — or you knowingly collect from them — you need verifiable parental consent before any data collection. The 2025 amendments tightened this further around third-party advertising.
• HIPAA 2 shared factors Privacy If your site collects, displays, or transmits protected health information, HIPAA applies. A privacy policy plus an explicit Notice of Privacy Practices and a clear consent flow are the minimum visible signals.
• LGPD 2 shared factors Privacy Brazil's GDPR analogue. If you serve Brazilian residents, treat it like GDPR-lite: lawful basis, consent for cookies, a real privacy policy, and ANPD-shaped data subject rights.
• PIPEDA 2 shared factors Privacy Canada's federal privacy law for commercial activity. Built around 10 fair information principles — meaningful consent, accountability, and the right to access your data.

Other references

• regulation CPPA enforcement regulations
• spec Global Privacy Control (GPC)