ccpa

What it does

CCPA/CPRA Compliance Advisor provides a structured workflow to determine CCPA/CPRA applicability, classify data recipients, and manage consumer rights (know, delete, correct, opt-out, limit SPI, and opt-out mechanisms). It covers opt-out handling with GPC, ADMT obligations, SPI handling, data minimization, and enforcement context. It includes steps for documenting determinations, applying thresholds, and coordinating with service providers, contractors, and third parties.

How it works

The skill presents concrete steps and tables to follow:

• Confirm entity type and test three thresholds (revenue, data volume, monetization revenue).
• Classify each downstream data recipient as Service Provider, Contractor, or Third Party, with clear definitions and sale implications.
• Document determinations and reassess thresholds annually or upon contract changes.
• Apply consumer rights workflows (Know, Delete, Correct, Opt-Out, Limit SPI, Data Portability, Non-Discrimination) with specified response timelines and extension rules.
• Implement Right to Opt-Out workflows, including GPC handling, update of consent/preference platforms within 15 business days, propagation to providers/contractors, and a 12-month non-re-engagement window after opt-out.
• Process Right to Limit SPI using a dedicated link, with 15-business-day processing and propagation to providers/contractors.
• Outline Right to Delete with a two-step confirmation and obligations to instruct service providers/contractors to delete.
• Provide step-by-step Right to Know workflow detailing logging, identity verification, data search, compilation, applying exceptions, and delivery within 45 days.
• Include intake/identity verification standards, and general request-handling principles (timelines, channels, verification tiers).

When to use it

Use when assessing whether CCPA/CPRA applies to a business, drafting data-sharing classifications, or executing consumer rights requests under CPRA/CCPA, including opt-out workflows and SPI limitations. Use for guidance on CPPA enforcement references and examples (e.g., notable penalties).

What it can touch

• Provisions and workflows for Right to Know, Delete, Correct, Opt-Out of Sale/Sharing, Limit SPI, Non-Discrimination, Data Portability, and Authorized Agent handling.
• Opt-out mechanisms including GPC handling and signaling.
• Classification of data recipients (Service Provider, Contractor, Third Party).
• Timelines and verification procedures for requests and deletions.
• Documentation and record-keeping requirements, including annual reassessment of thresholds.

Caveats

• Contains enforcement examples and thresholds; real-world applicability may vary by jurisdiction updates and entity-specific details.
• License and usage constraints are not explicitly covered beyond the stated content and need alignment with organizational compliance programs.