Skip to main content

CCPA and CPRA (California privacy)

Risk & governance

California laws giving consumers rights over personal information businesses collect—relevant when AI tools process customer or employee data.

The CCPA (California Consumer Privacy Act) and its amendments (CPRA) require transparency, opt-outs for certain “sales/sharing,” and security practices for covered data. Engineering teams see this when prompts, logs, or fine-tuning datasets include California residents’ PII.

Not legal advice

Map processing to your privacy counsel; pair with GDPR thinking when you operate globally.