CCPA/CPRA Compliance
the data inventory is the deliverable.
CCPA/CPRA compliance for California mid-market businesses — the thresholds that pull most organizations into scope ($25M revenue, 100K+ consumers, or 50%+ revenue from data sales/sharing), the written data inventory that makes opt-outs and consumer rights actually work, the privacy notice and request handling workflow, and the DPIA where required. The CPPA enforces.
CCPA/CPRA — the data inventory makes consumer rights actually work
The California Consumer Privacy Act (CCPA, effective January 2020), as substantially amended by the California Privacy Rights Act (CPRA, effective January 2023 with enforcement July 2023). The California Privacy Protection Agency (CPPA) — the dedicated enforcement agency with rulemaking and audit authority. Thresholds that put most California mid-market businesses in scope: $25 million annual gross revenue, 100,000 or more California consumer records, or 50% or more revenue from selling or sharing personal information.
The visibility problem is real. Most businesses cannot answer basic questions: what categories of personal information they collect, where it's stored, what processors and third parties have access, what retention periods apply, how a verifiable consumer request would actually get fulfilled. The privacy notice on the website was drafted in 2020 and has not been updated. The "Do Not Sell or Share My Personal Information" link goes to a form nobody monitors. The data inventory is the foundational document — without it, none of the consumer rights actually work.
This page covers WCC's CCPA/CPRA practice. For broader compliance work, see vCISO services. For the technical controls layer, see MFA management and the cybersecurity hub. Start with a free IT consultation.
Three CCPA/CPRA realities that defeat baseline programs
CPPA enforcement is active. These are the three realities most baseline programs fail.
The data inventory is the deliverable
The CCPA/CPRA rights — know, delete, correct, opt-out, limit — only work if you actually know what data you have. Most businesses don't. The written data inventory mapping personal information categories, sources, purposes, retention, processors, and third parties is the foundational deliverable everything else depends on.
$25M, 100K consumers, or 50%
CCPA/CPRA applies to for-profit businesses meeting any one of three thresholds: $25 million gross annual revenue (prior year), 100,000 or more California consumer records, or 50% or more revenue from selling or sharing personal information. Most California mid-market businesses cross the revenue threshold. The threshold check is the first deliverable.
CPPA enforcement is active
The California Privacy Protection Agency became operational in 2023 with rulemaking and enforcement authority. Penalties: $2,500 per violation, $7,500 per intentional violation, $7,500 per violation involving minors' data. Enforcement actions have targeted technical failures — broken opt-out links, missing privacy notices, retention violations.
Why choose WCC for CCPA/CPRA
California privacy compliance requires both regulatory expertise and operational implementation. The right partner has both — not just policy templates, not just technical controls.
22+ years SoCal compliance work
Two decades of regulated SoCal infrastructure. California privacy frameworks are not a learning curve — they sit alongside GLBA, HIPAA, and PCI work already in the practice.
Foundational deliverable
Every engagement produces a written data inventory mapping categories, sources, processors, third parties, and retention — in the first 60 days. Not a checklist. A working document.
Enforcement-focused program
Program designed around what the CPPA actually enforces — broken opt-out workflows, missing privacy notices, retention violations, vendor mapping gaps. Not generic policy templates.
Verifiable request workflow
Consumer request workflow with identity verification, response timelines (45 days, extendable by 45), and audit logging — not a form that goes to an unwatched inbox.
The six service areas of CCPA/CPRA compliance
Every CCPA/CPRA engagement is structured around the six operational areas the CPPA actually enforces. Each engagement is scoped to organization size and existing maturity.
Threshold Assessment
Written assessment against the three CCPA/CPRA thresholds — revenue, consumer records, data sales/sharing percentage. Documented scope memo. Reviewed annually as the business changes. The first deliverable.
Personal Information Inventory
Written data inventory: categories collected, sources, purposes, retention periods, third-party recipients, processors, and security measures. Foundational document for everything else. Updated as systems change.
Privacy Notice & Disclosures
At-collection notice updates. Privacy policy current with CPRA. Sensitive personal information disclosures. Do Not Sell or Share My Personal Information link engineered to actually work, not just exist.
Consumer Request Workflow
Verifiable consumer request handling: know, delete, correct, opt-out, limit use of sensitive PI. Identity verification. Response timelines. Audit logging. The form goes somewhere a human responds within 45 days.
Service Provider Contracts
Service provider and contractor contract language meeting CCPA/CPRA requirements. Vendor mapping aligned with the data inventory. Subprocessor disclosure. Annual contract review.
DPIA & Risk Assessment
Data Protection Impact Assessment (DPIA / privacy risk assessment) where required under CPRA — high-risk processing, sensitive personal information, profiling. CPPA-aligned methodology and documentation.
CCPA/CPRA compliance — common questions
CCPA/CPRA applies to any for-profit business doing business in California that meets any one of three thresholds: $25 million or more in gross annual revenue (prior calendar year), buying, selling, or sharing personal information of 100,000 or more California consumers or households, or deriving 50% or more of annual revenue from selling or sharing personal information. Most California mid-market businesses cross the revenue threshold. Note: "doing business in California" is broader than having a California office — it includes selling to California consumers regardless of where the business is located.
CCPA (the California Consumer Privacy Act) was the original 2018 statute effective January 2020. CPRA (the California Privacy Rights Act) was a 2020 ballot initiative that substantially amended CCPA, effective January 2023 with enforcement starting July 2023. CPRA added the new consumer right to correct, the new category of "sensitive personal information" with its own limit-use right, expanded employee and B2B coverage, created the California Privacy Protection Agency (CPPA) as a dedicated enforcement agency, and added DPIA requirements for high-risk processing. CCPA/CPRA is now a single integrated framework.
"Selling" under CCPA/CPRA includes any transfer of personal information to a third party for monetary or other valuable consideration — broader than the common understanding of a "sale." "Sharing" was added by CPRA specifically to cover transfers for cross-context behavioral advertising regardless of whether consideration changes hands. Both trigger consumer opt-out rights. Many businesses that don't think they "sell" personal information actually do under the statute — advertising cookie usage, lead generation partnerships, and embedded analytics often qualify.
Five core consumer rights. Right to know: what categories of personal information are collected, sources, purposes, third parties. Right to delete: request deletion of personal information collected. Right to correct: request correction of inaccurate personal information (added by CPRA). Right to opt-out: opt out of the sale or sharing of personal information. Right to limit: limit the use and disclosure of sensitive personal information (added by CPRA). Each right has specific verification requirements and a 45-day response timeline (extendable by 45 days with notice).
The California Privacy Protection Agency (CPPA) is the dedicated state agency created by CPRA with rulemaking, enforcement, and audit authority over CCPA/CPRA. It became operational in 2023 and began enforcement actions immediately. Penalty structure: $2,500 per violation, $7,500 per intentional violation, $7,500 per violation involving minors' personal information. Enforcement actions have historically targeted technical implementation failures — broken opt-out links, missing or stale privacy notices, retention period violations, and gaps between privacy notice promises and actual practice.
Pricing depends on organization size, data inventory complexity, and existing maturity. Initial scoping and data inventory engagement typically runs $10,000-$25,000 as a fixed-fee project covering threshold assessment, data inventory development, privacy notice updates, and consumer request workflow build. Ongoing program management typically runs $2,000-$6,000 per month for mid-market businesses covering annual data inventory updates, consumer request handling, vendor management, and CPPA monitoring. Initial DPIA engagements (for high-risk processing) are typically $5,000-$12,000 per assessment.
CCPA/CPRA across Southern California
WCC delivers CCPA/CPRA programs across all six SoCal counties — remote-first for program work with onsite presence for data inventory fieldwork. Headquartered in Chino.
The data inventory is the foundational deliverable. Everything else depends on it.
CCPA/CPRA applies to most California mid-market businesses. The CPPA is enforcing. The thresholds catch you at $25M revenue, 100K consumers, or 50% data-driven revenue. The data inventory is the document that makes opt-outs, deletions, and consumer rights actually work. WCC will scope, inventory, and produce a CCPA/CPRA program — standalone or bundled with broader managed IT.