CCPA to CPRA: What In-House Counsel Still Get Wrong

California privacy law is now several years past the CPRA amendments, and the same handful of misunderstandings continue to surface in reviews.

1. Service provider is a status, not a label

Calling a vendor a service provider in the agreement does not make it one. The status depends on the contractual restrictions actually imposed — prohibitions on retaining, using or disclosing personal information outside the business purpose, on combining it with other data, and on selling it. Where those restrictions are absent, the transfer may be a sale or a share regardless of what the heading says, with opt-out consequences attached.

2. Sharing is not the same as selling

The CPRA added “sharing” for cross-context behavioural advertising, which does not require money to change hands. Most organisations that concluded they do not sell personal information nevertheless share it, because that is what standard advertising pixels do. The opt-out obligations follow.

3. Sensitive personal information has its own regime

A defined category — including precise geolocation, racial or ethnic origin, contents of communications, biometric data used for identification, and health and sexual orientation data — carrying a right to limit use and disclosure to specified purposes. It is not simply higher-risk personal information; it triggers a distinct notice and a distinct control.

4. Employee and B2B data is fully in scope

The exemptions expired. Job applicants, employees, contractors and business contacts have the full set of rights, which means notices at collection for staff, a rights process that handles HR data, and retention disclosures for personnel records. This remains the most common gap we find.

5. Retention disclosure is mandatory

Notices must state the retention period for each category, or the criteria used to determine it. “As long as necessary” is not criteria. This is a small drafting task that requires a real answer from the business, which is why it is so often postponed.

6. Contractor obligations flow down

Required contractual terms apply to service providers, contractors and third parties, and must be flowed down to sub-processors. A vendor programme that stops at the first tier does not meet the requirement.