Know what is on your site before a plaintiff’s firm does.Free website scanScan Your Site
Log in Sign up Book a demo
Solutions / CPRA · CCPA
CCPA · CPRA · GLOBAL PRIVACY CONTROL

California’s CPRA requires businesses to honor the Global Privacy Control as a valid opt-out signal.

The CPRA amended the CCPA to add a new “sharing” category for cross-context behavioral advertising, a right to limit the use of sensitive personal information, and a dedicated regulator, the CPPA. It also requires businesses to treat the Global Privacy Control as a valid opt-out-of-sale/sharing request, in addition to any opt-out link you provide. Captain Compliance is privacy compliance software that helps you configure GPC detection, opt-out workflows, and sensitive-PI controls on your site.

Start free Book Demo
GPC honored automaticallySale & sharing opt-outSensitive-PI limit flow
The shape of the risk

A regulator with a rulebook and a budget.

$7,500
Per violation

For intentional violations or those involving minors; $2,500 otherwise, per record.

GPC
Must be honored

The Global Privacy Control browser signal counts as a valid opt-out request.

CPPA
Dedicated agency

California created a standalone privacy regulator that actively writes rules and enforces.

SPI
New category

Sensitive personal information gets its own “limit the use” right under CPRA.

What you get

Software tools built for CPRA requirements.

The CPRA requires honoring opt-out signals like GPC and offering other privacy rights. Our software helps you configure and manage each requirement.

G

GPC detection

Detects the Global Privacy Control browser signal and applies it as a valid opt-out request automatically.

Consent Management
O

Do Not Sell / Share workflow

Configurable tooling to help route opt-out requests to your ad and analytics destinations.

Learn more
S

Limit sensitive PI

Software support for the CPRA "limit the use of my sensitive personal information" right.

Learn more
D

Rights fulfilment

Tools to help track access, deletion and correction requests within the 45-day window.

DSR Portal
T

Trust Center

A customer-facing page you can publish showing your privacy practices and opt-out choices.

Trust Center
R

Notice at collection

Templates and a generator to help keep CPRA notice-at-collection and privacy policy disclosures current.

Notice generator
How it fits your stack

One engine for California and its neighbors.

California started a wave. The same opt-out logic, GPC handling and sensitive-data controls you build for CPRA carry straight over to Virginia, Colorado, Connecticut and the dozen-plus states that followed. Build it once with us and route by state automatically.

Book a CPRA review
Rollout · typical US business
  • Day 1 — GPC detection live; opt-out signal honored
  • Week 1 — Do-Not-Sell/Share flow and SPI limit wired
  • Week 2 — DSR portal with 45-day clock deployed
  • Week 3 — Notice at collection + policy generated
  • Ongoing — CPPA rulemaking tracked and applied
Before / after

What changes when you add compliance software.

Without a program
  • "Do Not Sell" link exists but GPC signals go undetected
  • No workflow to route opt-out requests to ad and analytics tools
  • Sensitive-PI limit requests handled manually, if at all
  • Notice at collection outdated or missing
  • Rights requests tracked by hand, deadlines at risk
With Captain Compliance
  • GPC detected and applied as an opt-out automatically
  • Opt-out requests routed to your ad and analytics destinations
  • Sensitive-PI limit requests captured through your preference center
  • Notice at collection generated and kept current
  • Rights requests tracked with the 45-day clock and an audit trail
Questions teams ask

CPRA, answered plainly.

What’s the difference between CCPA and CPRA?+
The CPRA is an amendment that expanded the CCPA. It added the concept of “sharing” for cross-context behavioral advertising, created the sensitive-personal-information category and its limit right, and established the CPPA as a dedicated enforcement agency. When people say “CCPA” today they usually mean the CPRA-amended law.
Do we really have to honor GPC?+
Yes. California regulators have made clear the Global Privacy Control is a valid opt-out-of-sale/sharing signal that businesses must respect automatically. Our software can detect it server- and client-side and apply the opt-out without requiring the user to click anything.
Are we even in scope?+
Generally if you do business in California and meet one of the thresholds: $25M+ revenue, 100k+ consumers or households, or 50%+ revenue from selling/sharing personal information. We can help you assess scope as part of onboarding.
Is there a private right of action?+
Only in a narrow case: certain data breaches involving unencrypted, unredacted personal information. Most CPRA enforcement comes from the CPPA and the Attorney General, which is why keeping records of your opt-out and consent activity matters.
Does using Captain Compliance make us compliant?+
Captain Compliance is software that helps you implement CPRA requirements, such as GPC detection, opt-out workflows, sensitive-PI controls, notices, and rights-request tracking. It supports your compliance program but isn’t a substitute for legal advice about your specific obligations.

See how our software supports your CPRA program.

Configure GPC detection, opt-out workflows, and sensitive-PI controls with Captain Compliance. Start free.

Start free See pricing