California CCPA as amended by the CPRA

5 minutes 5 Questions

The most-tested state statute: consumer rights, sensitive personal information, contractor and service provider terms, and the California Privacy Protection Agency as a dedicated regulator.

Test mode:
Start practice test

CIPP/US - California CCPA as amended by the CPRA Example Questions

Test your knowledge of California CCPA as amended by the CPRA

Question 1

A privacy officer reviews the company's obligations under California's amended consumer privacy statute. Leadership asks how the law will be enforced against violators and whether consumers themselves can sue. Which statement most accurately analyzes the enforcement structure of this statute?

Correct Answer: A dedicated state privacy agency and the attorney general enforce most provisions, while a limited private right of action exists for certain data breaches

The CPRA amended the CCPA to create the California Privacy Protection Agency, which shares enforcement authority with the state attorney general, while consumers retain only a limited private right of action for specific unauthorized data breaches involving nonencrypted, nonredacted personal information.

The FTC does not enforce this state statute, and the private right of action does not extend to any violation. There is no broad private right of action covering all consumer rights. Consumers do not need the agency to decline a complaint before suing; the breach-based private right exists independently.

Key concept: CCPA/CPRA dual regulatory enforcement plus a narrow breach-only private right of action.

Question 2

A California-based online marketplace collects consumer purchase histories and, for a fee, shares this data with advertising networks that build cross-context behavioral profiles. A consumer submits a request telling the marketplace to stop this sharing for targeted advertising purposes. The compliance team debates how the amended statute treats this arrangement. How should the team characterize the consumer's request?

Correct Answer: The consumer is exercising the right to opt out of sharing personal information for cross-context behavioral advertising

The CPRA (amended CCPA) defines sharing as disclosing personal information for cross-context behavioral advertising, and grants consumers an explicit right to opt out of that sharing, which is precisely what this request accomplishes.

The sensitive personal information option is wrong because purchase histories are not classified as sensitive data, and the right to limit applies only to specified sensitive categories. Correction is wrong because the consumer is not disputing inaccuracy. Deletion is wrong because stopping sharing does not require erasing all profile data.

Key concept tested: the CPRA right to opt out of sharing for cross-context behavioral advertising.

Question 3

A consumer submits a verified request to a business asking it to delete all personal information the business has collected. The business obtained some of that information from a data broker and shared other portions with two service providers to fulfill orders. As the business builds its response, which obligation regarding downstream parties best reflects the deletion right under California's amended consumer privacy statute?

Correct Answer: Notify its service providers and contractors to delete the information, and pass the request to third parties the data was sold or shared with, unless an exception applies

Under the CCPA as amended by the CPRA, a business receiving a valid deletion request must delete its own records, direct its service providers and contractors to delete the information, and notify third parties to whom the data was sold or shared to do the same, subject to statutory exceptions.

The option limiting duties to internal records ignores the required downstream notifications. Notifying only the supplying data broker misplaces responsibility and omits the service providers. Requiring fresh consumer authorization before deletion inverts the process and has no statutory basis.

Key concept: scope of the deletion right and downstream notification obligations.

More California CCPA as amended by the CPRA questions
27 questions (total)
Start 27 question test

Other State Privacy Laws concepts

Applicability thresholds and exemptions in state privacy lawsCalifornia Consumer Privacy Act (CCPA) and CPRAConsumer rights common to the state comprehensive lawsFederal vs. State Authority and PreemptionKey Differences Among State Breach Notification LawsNYDFS Part 500 cybersecurity regulationOther Comprehensive State Privacy LawsRecent State Privacy Legislative DevelopmentsSensitive data and consent under state lawsState attorney general enforcement and cure periodsState biometric privacy lawsState consumer health data lawsState Data Breach Notification Law ElementsState Security Procedures and Cookie RegulationsState SSN and Data Destruction LawsUniversal opt-out mechanismsVirginia Consumer Data Protection Act (VCDPA)
All State Privacy Laws questions · CIPP/US practice test