CPRA Compliance Guide

The California Privacy Rights Act (CPRA) superseded CCPA on 1 January 2023. It is enforced by the California Privacy Protection Agency (CPPA) — a dedicated regulatory body, not just the Attorney General.

Official references

• California Privacy Protection Agency (CPPA) — the regulatory body that enforces CPRA
• CPPA — CPRA regulations (Title 11, Division 22)
• Cal. Civ. Code § 1798.100 et seq — CPRA statute text
• Global Privacy Control (GPC) specification — required signal under CPRA

CCPA vs. CPRA

Enabling CPRA mode

new ConsentiSetup({
  core: {
    regulation: 'cpra',
    autoHonorGPC: true,  // required — GPC denies sale and sharing cookies automatically
  },
})

Per-cookie category

In the dashboard Cookie Template Editor, enable the CPRA Category column and assign each data-selling or sharing cookie a category:

GPC — Global Privacy Control

When the GPC signal (navigator.globalPrivacyControl === true) is detected under CPRA, Consenti automatically:

1. Denies all cookies with cpraCategory: 'sale'
2. Denies all cookies with cpraCategory: 'sharing'
3. Leaves other cookies at their submitted value
4. Stores gpc_detected: true on the consent record

Server-side enforcement

The backend re-applies CPRA rules on every POST /consent and PUT /consent/:idregardless of what the client sends, so a compromised widget cannot bypass the rules:

// consent.service.ts — enforced server-side on every write
if (gpcDetected && regulation === 'cpra') {
  if (cookie.cpraCategory === 'sale' || cookie.cpraCategory === 'sharing') {
    effectiveConsent[cookie.id] = 'denied'
  }
}

Do Not Sell / Do Not Share button

Add a visible opt-out link on your site (required by CPRA for businesses that sell or share data). Use the '!' action to deny all non-mandatory cookies:

{
  "text": "Do Not Sell or Share My Personal Information",
  "type": "reject",
  "cookies": "!"
}

Migration from CCPA

Change regulation: 'ccpa' to regulation: 'cpra' and add cpraCategory to cookies that involve selling or sharing. Existing consent records remain valid — no forced re-consent unless your cookie categories change.

- regulation: 'ccpa'
+ regulation: 'cpra'