[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFGCDVC61ZSY29DYARSAYS":3,"skill-same:01M6AFGCDVC61ZSY29DYARSAYS":85},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":31,"linkOnly":32,"markdownContent":33,"markdownBody":34,"frontMatter":35,"refName":40,"commitSha":41,"skillDirectory":42,"forksCount":43,"repositoryHtmlUrl":44,"repositoryHomepageUrl":6,"ownerHtmlUrl":45,"ownerBlogUrl":46,"ownerDescription":47,"updatedAt":48,"install":49,"resources":62},"01M6AFGCDVC61ZSY29DYARSAYS","ccpa-cpra-compliance",null,"Complete CCPA\u002FCPRA compliance implementation covering California Civil Code §1798.100-199. Includes consumer rights framework, business obligations, service provider and contractor requirements, enforcement mechanisms, and CPPA rulemaking. Triggers on CCPA, CPRA, California privacy, consumer rights.","mukul975\u002FPrivacy-Data-Protection-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADNKWX1HF4Q5DKEXT5M774",336,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fccpa-cpra-compliance\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[24,25,26,27,28,29,30],"compliance","ccpa","ccpa cpra compliance","code","state","framework","privacy","2026-11-10 10:12:30",false,"---\nname: ccpa-cpra-compliance\ndescription: >-\n  Complete CCPA\u002FCPRA compliance implementation covering California Civil Code\n  §1798.100-199. Includes consumer rights framework, business obligations,\n  service provider and contractor requirements, enforcement mechanisms, and\n  CPPA rulemaking. Triggers on CCPA, CPRA, California privacy, consumer rights.\nlicense: Apache-2.0\nmetadata:\n  author: mukul975\n  version: \"1.0\"\n  domain: privacy\n  subdomain: us-state-privacy-laws\n  tags: \"ccpa, cpra, california-privacy, consumer-rights, business-obligations\"\n---\n\n# CCPA\u002FCPRA Compliance\n\n## Overview\n\nThe California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), establishes comprehensive consumer privacy rights under California Civil Code §1798.100-199. The CPRA, approved by voters on November 3, 2020 (Proposition 24), substantially amended the CCPA effective January 1, 2023, with a lookback period to January 1, 2022. The California Privacy Protection Agency (CPPA) was established as the first dedicated state privacy enforcement agency in the United States.\n\nThe CPRA replaced the California Attorney General as the primary enforcement body with the CPPA, added the category of sensitive personal information, created new consumer rights (correction and limit use of sensitive PI), expanded the definition of \"sharing\" for cross-context behavioral advertising, and introduced requirements for data processing agreements.\n\n## Applicability (§1798.140(d))\n\nA business is subject to CCPA\u002FCPRA if it:\n\n1. Has annual gross revenues exceeding $25,000,000 in the preceding calendar year (adjusted by the CPPA for inflation starting January 1, 2024)\n2. Annually buys, sells, or shares the personal information of 100,000 or more consumers or households (CPRA increased from 50,000)\n3. Derives 50% or more of its annual revenues from selling or sharing consumers' personal information\n\n**Liberty Commerce Inc. Assessment:**\nLiberty Commerce Inc., with annual revenues of $48 million and processing personal information of approximately 320,000 California consumers through its e-commerce platform, meets threshold (1) and threshold (2). Liberty Commerce Inc. is classified as a \"business\" under §1798.140(d).\n\n## Key Definitions\n\n### Personal Information (§1798.140(v))\n\nInformation that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Categories include:\n\n| Category | Examples |\n|----------|----------|\n| Identifiers | Real name, alias, postal address, unique personal identifier, online identifier, IP address, email, account name, SSN, driver's license, passport number |\n| Commercial Information | Records of personal property, products or services purchased, obtaining, or considered |\n| Biometric Information | Physiological, biological, or behavioral characteristics used to establish individual identity (fingerprint, face, voice, iris, keystroke patterns) |\n| Internet\u002FNetwork Activity | Browsing history, search history, information regarding interaction with website, application, or advertisement |\n| Geolocation Data | Physical location or movements |\n| Sensory Data | Audio, electronic, visual, thermal, olfactory, or similar information |\n| Professional\u002FEmployment | Current or past job-related information |\n| Education Information | Non-publicly available education records per FERPA (20 U.S.C. §1232g) |\n| Inferences | Profiles reflecting preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, aptitudes |\n| Sensitive PI (CPRA) | SSN\u002Fdriver's license\u002Fpassport, account log-in with password, precise geolocation, racial\u002Fethnic origin, religious\u002Fphilosophical beliefs, union membership, contents of mail\u002Femail\u002Ftext, genetic data, biometric data for identification, health information, sex life\u002Fsexual orientation data |\n\n### Sale (§1798.140(ad))\n\nSelling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer's personal information by the business to a third party for monetary or other valuable consideration.\n\n### Sharing (§1798.140(ah)) — Added by CPRA\n\nSharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating a consumer's personal information by the business to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, including situations where no money is exchanged.\n\n### Service Provider vs. Contractor (§1798.140(ag), §1798.140(j))\n\n| Aspect | Service Provider | Contractor |\n|--------|-----------------|------------|\n| Definition | Processes PI on behalf of business per written contract | Processes PI made available by business per written contract |\n| Contract Requirements | Written agreement prohibiting selling\u002Fsharing, limiting use to specified purposes | Written agreement with same prohibitions plus certification of understanding, grant of compliance audit rights |\n| Subcontracting | May engage subcontractors with written contract | May engage subcontractors with written contract and business notification |\n| Compliance Audits | Not expressly required in statute | Business has right to audit contractor compliance |\n\n## Consumer Rights\n\n### 1. Right to Know (§1798.100, §1798.110, §1798.115)\n\nConsumers may request that a business disclose:\n- Categories of PI collected\n- Categories of sources\n- Business or commercial purpose for collecting, selling, or sharing\n- Categories of third parties to whom PI is disclosed\n- Specific pieces of PI collected about the consumer\n\n**Lookback period:** 12 months preceding the request (business may voluntarily go beyond).\n\n**Liberty Commerce Inc. Implementation:**\nLiberty Commerce Inc. provides a \"Know My Data\" portal at privacy.libertycommerce.com\u002Fknow where verified consumers can request all five categories of disclosure. The system generates a structured report in machine-readable format (JSON) and human-readable format (PDF) within 10 business days.\n\n### 2. Right to Delete (§1798.105)\n\nConsumers may request deletion of personal information collected from them. Upon receiving a verified request, the business must delete the PI and direct service providers and contractors to delete the consumer's PI.\n\n**Exceptions (§1798.105(d)):** Transaction completion, security, error repair, free speech (Cal. Civ. Code §1798.105(d)(4)), internal uses reasonably aligned with consumer expectations, compliance with legal obligation, internal uses compatible with the context of collection.\n\n**Liberty Commerce Inc. Implementation:**\nLiberty Commerce Inc. processes deletion requests through a cascading deletion workflow that propagates to all service providers (payment processor, shipping partner, analytics provider) within 45 calendar days. Retained data for legal compliance (tax records per 26 U.S.C. §6001) is documented with the specific legal basis.\n\n### 3. Right to Correct (§1798.106) — Added by CPRA\n\nConsumers may request correction of inaccurate personal information. The business must use commercially reasonable efforts to correct the information.\n\n**Liberty Commerce Inc. Implementation:**\nLiberty Commerce Inc. allows consumers to self-correct profile data (name, address, email, phone) directly in their account. For data in backend systems (purchase history corrections, loyalty points), verified requests are processed through the privacy team with documentation of the correction.\n\n### 4. Right to Opt-Out of Sale\u002FSharing (§1798.120)\n\nConsumers have the right to direct a business that sells or shares their personal information to stop selling or sharing that information. The business must respect this direction.\n\n**Key requirements:**\n- \"Do Not Sell or Share My Personal Information\" link on homepage\n- Must honor Global Privacy Control (GPC) signals as valid opt-out requests (CPPA Regulations §7025)\n- No re-solicitation for 12 months after opt-out\n- Must not discriminate against consumers who opt out (§1798.125)\n\n**Liberty Commerce Inc. Implementation:**\nLiberty Commerce Inc. displays a persistent \"Do Not Sell or Share My Personal Information\" link in the footer of every page. The system detects GPC signals via the `Sec-GPC: 1` HTTP header and `navigator.globalPrivacyControl` JavaScript API, automatically applying opt-out status to the browsing session and associating it with the consumer's account if authenticated.\n\n### 5. Right to Limit Use of Sensitive PI (§1798.121) — Added by CPRA\n\nConsumers may direct a business to limit its use of sensitive personal information to specified purposes (performing services\u002Fproviding goods, preventing security incidents, resisting malicious\u002Fdeceptive actions, ensuring safety, short-term transient use, performing services on behalf of the business, verifying\u002Fmaintaining quality, upgrading\u002Fenhancing services).\n\n**Liberty Commerce Inc. Implementation:**\nLiberty Commerce Inc. displays a \"Limit the Use of My Sensitive Personal Information\" link adjacent to the opt-out link. When activated, the system restricts processing of sensitive PI categories (precise geolocation, racial\u002Fethnic origin data from surveys, payment card details beyond transaction processing) to the enumerated permitted purposes.\n\n### 6. Right to Non-Discrimination (§1798.125)\n\nA business may not discriminate against a consumer for exercising their CCPA rights, including by:\n- Denying goods or services\n- Charging different prices or rates\n- Providing a different level or quality of goods or services\n- Suggesting that the consumer will receive a different price or quality\n\n**Financial incentive programs** are permitted if the consumer is notified and opts in, the incentive is reasonably related to the value of the consumer's data, and the business can explain the valuation methodology.\n\n## Business Obligations\n\n### Privacy Notice (§1798.100(a), §1798.130(a)(5))\n\nThe privacy notice must be updated at least once every 12 months and include:\n- Categories of PI collected in the preceding 12 months\n- Categories of sensitive PI collected\n- Purposes for which each category is used and whether it is sold or shared\n- Length of time each category is retained (or criteria for determining retention) — added by CPRA\n- Categories of sources\n- Categories of third parties to which PI is disclosed\n- Instructions for submitting consumer requests\n- Whether the business sells or shares PI, and categories involved\n- Categories of PI disclosed for a business purpose\n\n**Liberty Commerce Inc. Implementation:**\nLiberty Commerce Inc. publishes its California Privacy Notice at privacy.libertycommerce.com\u002Fcalifornia, updated annually in January. The notice uses a layered format with a summary table followed by detailed sections. Retention periods are specified per data category (e.g., transaction records: 7 years per tax requirements; browsing data: 13 months; account data: duration of account plus 30 days).\n\n### Data Processing Agreements (§1798.100(d)) — Added by CPRA\n\nBusinesses must enter into agreements with service providers, contractors, and third parties that:\n- Specify the business purpose for which PI is made available\n- Require the recipient to comply with CCPA\u002FCPRA obligations\n- Grant the business rights to take reasonable steps to ensure compliance\n- Require notification if the recipient determines it can no longer meet its obligations\n- Grant the business the right to stop and remediate unauthorized use of PI\n\n### Data Minimization (§1798.100(c)) — Added by CPRA\n\nA business's collection, use, retention, and sharing of PI must be:\n- Reasonably necessary and proportionate to the purposes for which the PI was collected or processed\n- Not further processed in a manner incompatible with those purposes\n\n### Consumer Request Processing (§1798.130)\n\n| Requirement | Detail |\n|-------------|--------|\n| Response deadline | 45 calendar days from receipt of verifiable request |\n| Extension | Up to 45 additional days (90 total) with notice to consumer |\n| Verification | Reasonable methods to verify identity; match at least two data points for access; three data points for specific pieces |\n| Authorized agents | Must accept requests from authorized agents with signed permission or power of attorney |\n| Free requests | At least two free requests per 12-month period |\n| Format | Delivered in readily usable, machine-readable format (for portability requests) |\n| Toll-free number | Required for businesses that operate exclusively online only if they have a direct relationship with the consumer |\n\n### Record Keeping (CPPA Regulations §7101)\n\nBusinesses that buy, receive, or sell the PI of 10,000,000 or more consumers must compile metrics for the prior calendar year and disclose:\n- Number of requests to know, delete, correct, and opt-out received\n- Number of requests complied with in whole or in part\n- Number of requests denied\n- Median number of days to respond\n\n## Enforcement\n\n### CPPA Enforcement (§1798.199.40-199.100)\n\n- Administrative enforcement actions by the CPPA\n- Administrative fines up to $2,500 per violation; $7,500 per intentional violation or violations involving minors under 16\n- CPPA has authority to issue regulations, conduct investigations, and bring enforcement actions\n- 30-day cure period was eliminated by CPRA effective January 1, 2023\n\n### Private Right of Action (§1798.150)\n\nLimited to data breach claims where nonencrypted and nonredacted PI (as defined in Cal. Civ. Code §1798.81.5(d)(1)(A)) is subject to unauthorized access due to the business's failure to implement reasonable security measures.\n\n- Statutory damages: $100-$750 per consumer per incident, or actual damages (whichever is greater)\n- Injunctive or declaratory relief\n- Any other relief the court deems proper\n- 30-day notice and cure period before filing suit\n\n## Implementation Roadmap for Liberty Commerce Inc.\n\n### Phase 1: Assessment (Weeks 1-4)\n1. Data inventory and mapping of all PI and sensitive PI categories\n2. Identify all data flows: collection, use, sale, sharing, disclosure\n3. Map service providers, contractors, and third parties\n4. Assess current privacy notice against CPRA requirements\n5. Evaluate consumer request processing workflows\n\n### Phase 2: Legal Framework (Weeks 5-8)\n6. Update privacy notice with retention periods, sensitive PI categories, sale\u002Fsharing disclosures\n7. Draft\u002Fupdate data processing agreements for all service providers and contractors\n8. Develop consumer request verification procedures\n9. Establish authorized agent acceptance procedures\n10. Create financial incentive program valuation methodology (if applicable)\n\n### Phase 3: Technical Implementation (Weeks 9-16)\n11. Deploy \"Do Not Sell or Share My Personal Information\" link\n12. Deploy \"Limit the Use of My Sensitive Personal Information\" link\n13. Implement GPC signal detection and honoring\n14. Build consumer request intake portal with identity verification\n15. Implement cascading deletion workflow\n16. Build right-to-know report generation (JSON and PDF)\n17. Implement data minimization controls and retention enforcement\n\n### Phase 4: Operations (Weeks 17-20)\n18. Train customer service team on CCPA\u002FCPRA consumer rights\n19. Establish 45-day SLA monitoring for consumer requests\n20. Implement metrics tracking per CPPA Regulations §7101\n21. Schedule annual privacy notice review\n22. Conduct tabletop exercise for consumer request processing\n\n## Key Regulatory References\n\n- California Civil Code §1798.100-199 (CCPA as amended by CPRA)\n- California Privacy Rights Act (Proposition 24, approved November 3, 2020)\n- CPPA Final Regulations (effective March 29, 2023; updated regulations effective March 29, 2024)\n- CPPA Regulations §7001-7102 (Title 11, Division 6, California Code of Regulations)\n- Cal. Civ. Code §1798.81.5 — Data breach notification\n- AG Enforcement Actions: Sephora Inc. ($1.2 million settlement, August 2022) — first public CCPA enforcement action for failure to honor GPC opt-out signals\n- CPPA Enforcement Advisory No. 2024-01 — Dark patterns in consent interfaces\n","# CCPA\u002FCPRA Compliance\n\n## Overview\n\nThe California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), establishes comprehensive consumer privacy rights under California Civil Code §1798.100-199. The CPRA, approved by voters on November 3, 2020 (Proposition 24), substantially amended the CCPA effective January 1, 2023, with a lookback period to January 1, 2022. The California Privacy Protection Agency (CPPA) was established as the first dedicated state privacy enforcement agency in the United States.\n\nThe CPRA replaced the California Attorney General as the primary enforcement body with the CPPA, added the category of sensitive personal information, created new consumer rights (correction and limit use of sensitive PI), expanded the definition of \"sharing\" for cross-context behavioral advertising, and introduced requirements for data processing agreements.\n\n## Applicability (§1798.140(d))\n\nA business is subject to CCPA\u002FCPRA if it:\n\n1. Has annual gross revenues exceeding $25,000,000 in the preceding calendar year (adjusted by the CPPA for inflation starting January 1, 2024)\n2. Annually buys, sells, or shares the personal information of 100,000 or more consumers or households (CPRA increased from 50,000)\n3. Derives 50% or more of its annual revenues from selling or sharing consumers' personal information\n\n**Liberty Commerce Inc. Assessment:**\nLiberty Commerce Inc., with annual revenues of $48 million and processing personal information of approximately 320,000 California consumers through its e-commerce platform, meets threshold (1) and threshold (2). Liberty Commerce Inc. is classified as a \"business\" under §1798.140(d).\n\n## Key Definitions\n\n### Personal Information (§1798.140(v))\n\nInformation that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Categories include:\n\n| Category | Examples |\n|----------|----------|\n| Identifiers | Real name, alias, postal address, unique personal identifier, online identifier, IP address, email, account name, SSN, driver's license, passport number |\n| Commercial Information | Records of personal property, products or services purchased, obtaining, or considered |\n| Biometric Information | Physiological, biological, or behavioral characteristics used to establish individual identity (fingerprint, face, voice, iris, keystroke patterns) |\n| Internet\u002FNetwork Activity | Browsing history, search history, information regarding interaction with website, application, or advertisement |\n| Geolocation Data | Physical location or movements |\n| Sensory Data | Audio, electronic, visual, thermal, olfactory, or similar information |\n| Professional\u002FEmployment | Current or past job-related information |\n| Education Information | Non-publicly available education records per FERPA (20 U.S.C. §1232g) |\n| Inferences | Profiles reflecting preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, aptitudes |\n| Sensitive PI (CPRA) | SSN\u002Fdriver's license\u002Fpassport, account log-in with password, precise geolocation, racial\u002Fethnic origin, religious\u002Fphilosophical beliefs, union membership, contents of mail\u002Femail\u002Ftext, genetic data, biometric data for identification, health information, sex life\u002Fsexual orientation data |\n\n### Sale (§1798.140(ad))\n\nSelling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer's personal information by the business to a third party for monetary or other valuable consideration.\n\n### Sharing (§1798.140(ah)) — Added by CPRA\n\nSharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating a consumer's personal information by the business to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, including situations where no money is exchanged.\n\n### Service Provider vs. Contractor (§1798.140(ag), §1798.140(j))\n\n| Aspect | Service Provider | Contractor |\n|--------|-----------------|------------|\n| Definition | Processes PI on behalf of business per written contract | Processes PI made available by business per written contract |\n| Contract Requirements | Written agreement prohibiting selling\u002Fsharing, limiting use to specified purposes | Written agreement with same prohibitions plus certification of understanding, grant of compliance audit rights |\n| Subcontracting | May engage subcontractors with written contract | May engage subcontractors with written contract and business notification |\n| Compliance Audits | Not expressly required in statute | Business has right to audit contractor compliance |\n\n## Consumer Rights\n\n### 1. Right to Know (§1798.100, §1798.110, §1798.115)\n\nConsumers may request that a business disclose:\n- Categories of PI collected\n- Categories of sources\n- Business or commercial purpose for collecting, selling, or sharing\n- Categories of third parties to whom PI is disclosed\n- Specific pieces of PI collected about the consumer\n\n**Lookback period:** 12 months preceding the request (business may voluntarily go beyond).\n\n**Liberty Commerce Inc. Implementation:**\nLiberty Commerce Inc. provides a \"Know My Data\" portal at privacy.libertycommerce.com\u002Fknow where verified consumers can request all five categories of disclosure. The system generates a structured report in machine-readable format (JSON) and human-readable format (PDF) within 10 business days.\n\n### 2. Right to Delete (§1798.105)\n\nConsumers may request deletion of personal information collected from them. Upon receiving a verified request, the business must delete the PI and direct service providers and contractors to delete the consumer's PI.\n\n**Exceptions (§1798.105(d)):** Transaction completion, security, error repair, free speech (Cal. Civ. Code §1798.105(d)(4)), internal uses reasonably aligned with consumer expectations, compliance with legal obligation, internal uses compatible with the context of collection.\n\n**Liberty Commerce Inc. Implementation:**\nLiberty Commerce Inc. processes deletion requests through a cascading deletion workflow that propagates to all service providers (payment processor, shipping partner, analytics provider) within 45 calendar days. Retained data for legal compliance (tax records per 26 U.S.C. §6001) is documented with the specific legal basis.\n\n### 3. Right to Correct (§1798.106) — Added by CPRA\n\nConsumers may request correction of inaccurate personal information. The business must use commercially reasonable efforts to correct the information.\n\n**Liberty Commerce Inc. Implementation:**\nLiberty Commerce Inc. allows consumers to self-correct profile data (name, address, email, phone) directly in their account. For data in backend systems (purchase history corrections, loyalty points), verified requests are processed through the privacy team with documentation of the correction.\n\n### 4. Right to Opt-Out of Sale\u002FSharing (§1798.120)\n\nConsumers have the right to direct a business that sells or shares their personal information to stop selling or sharing that information. The business must respect this direction.\n\n**Key requirements:**\n- \"Do Not Sell or Share My Personal Information\" link on homepage\n- Must honor Global Privacy Control (GPC) signals as valid opt-out requests (CPPA Regulations §7025)\n- No re-solicitation for 12 months after opt-out\n- Must not discriminate against consumers who opt out (§1798.125)\n\n**Liberty Commerce Inc. Implementation:**\nLiberty Commerce Inc. displays a persistent \"Do Not Sell or Share My Personal Information\" link in the footer of every page. The system detects GPC signals via the `Sec-GPC: 1` HTTP header and `navigator.globalPrivacyControl` JavaScript API, automatically applying opt-out status to the browsing session and associating it with the consumer's account if authenticated.\n\n### 5. Right to Limit Use of Sensitive PI (§1798.121) — Added by CPRA\n\nConsumers may direct a business to limit its use of sensitive personal information to specified purposes (performing services\u002Fproviding goods, preventing security incidents, resisting malicious\u002Fdeceptive actions, ensuring safety, short-term transient use, performing services on behalf of the business, verifying\u002Fmaintaining quality, upgrading\u002Fenhancing services).\n\n**Liberty Commerce Inc. Implementation:**\nLiberty Commerce Inc. displays a \"Limit the Use of My Sensitive Personal Information\" link adjacent to the opt-out link. When activated, the system restricts processing of sensitive PI categories (precise geolocation, racial\u002Fethnic origin data from surveys, payment card details beyond transaction processing) to the enumerated permitted purposes.\n\n### 6. Right to Non-Discrimination (§1798.125)\n\nA business may not discriminate against a consumer for exercising their CCPA rights, including by:\n- Denying goods or services\n- Charging different prices or rates\n- Providing a different level or quality of goods or services\n- Suggesting that the consumer will receive a different price or quality\n\n**Financial incentive programs** are permitted if the consumer is notified and opts in, the incentive is reasonably related to the value of the consumer's data, and the business can explain the valuation methodology.\n\n## Business Obligations\n\n### Privacy Notice (§1798.100(a), §1798.130(a)(5))\n\nThe privacy notice must be updated at least once every 12 months and include:\n- Categories of PI collected in the preceding 12 months\n- Categories of sensitive PI collected\n- Purposes for which each category is used and whether it is sold or shared\n- Length of time each category is retained (or criteria for determining retention) — added by CPRA\n- Categories of sources\n- Categories of third parties to which PI is disclosed\n- Instructions for submitting consumer requests\n- Whether the business sells or shares PI, and categories involved\n- Categories of PI disclosed for a business purpose\n\n**Liberty Commerce Inc. Implementation:**\nLiberty Commerce Inc. publishes its California Privacy Notice at privacy.libertycommerce.com\u002Fcalifornia, updated annually in January. The notice uses a layered format with a summary table followed by detailed sections. Retention periods are specified per data category (e.g., transaction records: 7 years per tax requirements; browsing data: 13 months; account data: duration of account plus 30 days).\n\n### Data Processing Agreements (§1798.100(d)) — Added by CPRA\n\nBusinesses must enter into agreements with service providers, contractors, and third parties that:\n- Specify the business purpose for which PI is made available\n- Require the recipient to comply with CCPA\u002FCPRA obligations\n- Grant the business rights to take reasonable steps to ensure compliance\n- Require notification if the recipient determines it can no longer meet its obligations\n- Grant the business the right to stop and remediate unauthorized use of PI\n\n### Data Minimization (§1798.100(c)) — Added by CPRA\n\nA business's collection, use, retention, and sharing of PI must be:\n- Reasonably necessary and proportionate to the purposes for which the PI was collected or processed\n- Not further processed in a manner incompatible with those purposes\n\n### Consumer Request Processing (§1798.130)\n\n| Requirement | Detail |\n|-------------|--------|\n| Response deadline | 45 calendar days from receipt of verifiable request |\n| Extension | Up to 45 additional days (90 total) with notice to consumer |\n| Verification | Reasonable methods to verify identity; match at least two data points for access; three data points for specific pieces |\n| Authorized agents | Must accept requests from authorized agents with signed permission or power of attorney |\n| Free requests | At least two free requests per 12-month period |\n| Format | Delivered in readily usable, machine-readable format (for portability requests) |\n| Toll-free number | Required for businesses that operate exclusively online only if they have a direct relationship with the consumer |\n\n### Record Keeping (CPPA Regulations §7101)\n\nBusinesses that buy, receive, or sell the PI of 10,000,000 or more consumers must compile metrics for the prior calendar year and disclose:\n- Number of requests to know, delete, correct, and opt-out received\n- Number of requests complied with in whole or in part\n- Number of requests denied\n- Median number of days to respond\n\n## Enforcement\n\n### CPPA Enforcement (§1798.199.40-199.100)\n\n- Administrative enforcement actions by the CPPA\n- Administrative fines up to $2,500 per violation; $7,500 per intentional violation or violations involving minors under 16\n- CPPA has authority to issue regulations, conduct investigations, and bring enforcement actions\n- 30-day cure period was eliminated by CPRA effective January 1, 2023\n\n### Private Right of Action (§1798.150)\n\nLimited to data breach claims where nonencrypted and nonredacted PI (as defined in Cal. Civ. Code §1798.81.5(d)(1)(A)) is subject to unauthorized access due to the business's failure to implement reasonable security measures.\n\n- Statutory damages: $100-$750 per consumer per incident, or actual damages (whichever is greater)\n- Injunctive or declaratory relief\n- Any other relief the court deems proper\n- 30-day notice and cure period before filing suit\n\n## Implementation Roadmap for Liberty Commerce Inc.\n\n### Phase 1: Assessment (Weeks 1-4)\n1. Data inventory and mapping of all PI and sensitive PI categories\n2. Identify all data flows: collection, use, sale, sharing, disclosure\n3. Map service providers, contractors, and third parties\n4. Assess current privacy notice against CPRA requirements\n5. Evaluate consumer request processing workflows\n\n### Phase 2: Legal Framework (Weeks 5-8)\n6. Update privacy notice with retention periods, sensitive PI categories, sale\u002Fsharing disclosures\n7. Draft\u002Fupdate data processing agreements for all service providers and contractors\n8. Develop consumer request verification procedures\n9. Establish authorized agent acceptance procedures\n10. Create financial incentive program valuation methodology (if applicable)\n\n### Phase 3: Technical Implementation (Weeks 9-16)\n11. Deploy \"Do Not Sell or Share My Personal Information\" link\n12. Deploy \"Limit the Use of My Sensitive Personal Information\" link\n13. Implement GPC signal detection and honoring\n14. Build consumer request intake portal with identity verification\n15. Implement cascading deletion workflow\n16. Build right-to-know report generation (JSON and PDF)\n17. Implement data minimization controls and retention enforcement\n\n### Phase 4: Operations (Weeks 17-20)\n18. Train customer service team on CCPA\u002FCPRA consumer rights\n19. Establish 45-day SLA monitoring for consumer requests\n20. Implement metrics tracking per CPPA Regulations §7101\n21. Schedule annual privacy notice review\n22. Conduct tabletop exercise for consumer request processing\n\n## Key Regulatory References\n\n- California Civil Code §1798.100-199 (CCPA as amended by CPRA)\n- California Privacy Rights Act (Proposition 24, approved November 3, 2020)\n- CPPA Final Regulations (effective March 29, 2023; updated regulations effective March 29, 2024)\n- CPPA Regulations §7001-7102 (Title 11, Division 6, California Code of Regulations)\n- Cal. Civ. Code §1798.81.5 — Data breach notification\n- AG Enforcement Actions: Sephora Inc. ($1.2 million settlement, August 2022) — first public CCPA enforcement action for failure to honor GPC opt-out signals\n- CPPA Enforcement Advisory No. 2024-01 — Dark patterns in consent interfaces\n",{"name":5,"license":15,"metadata":36,"description":7},{"tags":37,"author":9,"domain":30,"version":38,"subdomain":39},"ccpa, cpra, california-privacy, consumer-rights, business-obligations","1.0","us-state-privacy-laws","main","9b2ef9eae161c00a17241d42a388571321b33e9f","skills\u002Fprivacy\u002Fccpa-cpra-compliance",67,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-03-17 04:06:52",{"source":8,"skillName":5,"commands":50,"prompt":60,"zipAvailable":61},[51,54,57],{"tool":52,"command":53},"npx","npx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill ccpa-cpra-compliance",{"tool":55,"command":56},"bunx","bunx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill ccpa-cpra-compliance",{"tool":58,"command":59},"pnpm","pnpm dlx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill ccpa-cpra-compliance","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fccpa-cpra-compliance\u002FSKILL.md",true,[63,69,75,79],{"path":64,"resourceType":65,"resourceTypeDesc":66,"sizeBytes":67,"sourceHtmlUrl":68},"assets\u002Ftemplate.md","ASSET","资产文件",5586,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fccpa-cpra-compliance\u002Fassets\u002Ftemplate.md",{"path":70,"resourceType":71,"resourceTypeDesc":72,"sizeBytes":73,"sourceHtmlUrl":74},"references\u002Fstandards.md","REFERENCE","参考文档",4195,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fccpa-cpra-compliance\u002Freferences\u002Fstandards.md",{"path":76,"resourceType":71,"resourceTypeDesc":72,"sizeBytes":77,"sourceHtmlUrl":78},"references\u002Fworkflows.md",7554,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fccpa-cpra-compliance\u002Freferences\u002Fworkflows.md",{"path":80,"resourceType":81,"resourceTypeDesc":82,"sizeBytes":83,"sourceHtmlUrl":84},"scripts\u002Fprocess.py","SCRIPT","脚本",13588,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fccpa-cpra-compliance\u002Fscripts\u002Fprocess.py",[86,110,127,140,157,170],{"skillNo":87,"name":88,"nameZh":6,"description":89,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":90,"categories":91,"keywords":101,"publishedAt":31},"01M6AG6K8R3XW10ENWH2FH18RH","workplace-email-privacy","Implements email and internet monitoring compliance in the workplace per Barbulescu v Romania (ECHR Grand Chamber), EDPB guidance, and national labour law. Covers acceptable use policies, legitimate expectation of privacy, proportionality testing, and content vs metadata monitoring. Keywords: email monitoring, Barbulescu, workplace privacy, internet monitoring, acceptable use policy, ECHR, proportionality.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fworkplace-email-privacy\u002FSKILL.md",[92,97,100],{"categoryNo":93,"categoryName":94,"taxonomyType":95,"taxonomyTypeDesc":96},"01JBSEEDCAT000000000000005","邮件与沟通","SCENARIO","使用场景",{"categoryNo":98,"categoryName":99,"taxonomyType":95,"taxonomyTypeDesc":96},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[102,103,30,24,104,105,106,107,108,109],"email","workplace email privacy","content","data","policy","testing","monitoring","metadata",{"skillNo":111,"name":112,"nameZh":6,"description":113,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":114,"categories":115,"keywords":120,"publishedAt":31},"01M6AG6FRCBJY7D061BJZMNV49","whistleblower-data","Implements data protection compliance for whistleblowing systems under EU Directive 2019\u002F1937 and GDPR. Covers anonymous reporting channels, identity protection for whistleblowers and accused persons, retention limits, access restrictions, and retaliation prevention. Addresses national transpositions and DPA guidance. Keywords: whistleblower, Directive 2019\u002F1937, anonymous reporting, identity protection, retaliation, retention, reporting channel.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fwhistleblower-data\u002FSKILL.md",[116,119],{"categoryNo":117,"categoryName":118,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000033","数据分析师",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[105,121,122,123,24,124,125,30,126],"whistleblower data","identity","reporting","data protection","gdpr","prevention",{"skillNo":128,"name":129,"nameZh":6,"description":130,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":131,"categories":132,"keywords":134,"publishedAt":31},"01M6AG6CJP0PW3X65HC7VP9SR9","vendor-termination-data","Vendor termination data return and deletion procedures per GDPR Article 28(3)(g). Covers data extraction formats, deletion certification requirements, transition planning, residual data handling, and post-termination verification.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-termination-data\u002FSKILL.md",[133],{"categoryNo":117,"categoryName":118,"taxonomyType":21,"taxonomyTypeDesc":22},[105,135,136,137,138,125,30,139],"vendor termination data","planning","verification","extraction","certification",{"skillNo":141,"name":142,"nameZh":6,"description":143,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":144,"categories":145,"keywords":147,"publishedAt":31},"01M6AG69E277DXZB2NF6KV17ZA","vendor-risk-scoring","Vendor privacy risk tiering methodology for processor management. Covers scoring factors including data volume, sensitivity, transfer locations, certifications, breach history, and control maturity with weighted risk calculation and tier assignment.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-risk-scoring\u002FSKILL.md",[146],{"categoryNo":117,"categoryName":118,"taxonomyType":21,"taxonomyTypeDesc":22},[148,149,150,151,152,153,154,155,30,105,156],"vendor risk scoring","risk","risk scoring","methodology","risk-scoring","assessment","transfer","certifications","processor",{"skillNo":158,"name":159,"nameZh":6,"description":160,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":161,"categories":162,"keywords":164,"publishedAt":31},"01M6AG6655ABFKT2BBWHCP4PAT","vendor-privacy-due-diligence","Pre-contract vendor privacy due diligence per GDPR Article 28(1). Covers risk questionnaires, technical controls assessment, certification review, data flow analysis, and documented sufficiency decisions for processor engagement.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-privacy-due-diligence\u002FSKILL.md",[163],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[30,165,125,166,153,167,168,105,156,149,139,169],"vendor privacy due diligence","review","onboarding","flow","analysis",{"skillNo":171,"name":172,"nameZh":6,"description":173,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":174,"categories":175,"keywords":183,"publishedAt":31},"01M6AG62C3VD8SYNGH4N7RHZTE","vendor-privacy-audit","On-site and remote vendor audit procedures per GDPR Article 28(3)(h). Covers audit planning, evidence collection methodologies, finding classification, remediation tracking, and audit report generation for processor compliance verification.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-privacy-audit\u002FSKILL.md",[176,179,182],{"categoryNo":177,"categoryName":178,"taxonomyType":95,"taxonomyTypeDesc":96},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":180,"categoryName":181,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000036","内容创作者",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[184,185,30,186,137,187,24,125,188,156,189,190,191,136],"vendor privacy audit","audit","report","audit report","remediation","collection","remediation-tracking","classification"]