Implements CCPA/CPRA compliance covering California Civil Code §1798.100-199, consumer rights, business obligations, service providers, enforcement, and CPPA rulemaking. Triggers on CCPA, CPRA, privacy queries.
npx claudepluginhub mukul975/privacy-data-protection-skills --plugin us-state-privacy-skillsThis skill uses the workspace's default tool permissions.
The California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), establishes comprehensive consumer privacy rights under California Civil Code §1798.100-199. The CPRA, approved by voters on November 3, 2020 (Proposition 24), substantially amended the CCPA effective January 1, 2023, with a lookback period to January 1, 2022. The California Privacy Protection Ag...
Generates design tokens/docs from CSS/Tailwind/styled-components codebases, audits visual consistency across 10 dimensions, detects AI slop in UI.
Records polished WebM UI demo videos of web apps using Playwright with cursor overlay, natural pacing, and three-phase scripting. Activates for demo, walkthrough, screen recording, or tutorial requests.
Delivers idiomatic Kotlin patterns for null safety, immutability, sealed classes, coroutines, Flows, extensions, DSL builders, and Gradle DSL. Use when writing, reviewing, refactoring, or designing Kotlin code.
The California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), establishes comprehensive consumer privacy rights under California Civil Code §1798.100-199. The CPRA, approved by voters on November 3, 2020 (Proposition 24), substantially amended the CCPA effective January 1, 2023, with a lookback period to January 1, 2022. The California Privacy Protection Agency (CPPA) was established as the first dedicated state privacy enforcement agency in the United States.
The CPRA replaced the California Attorney General as the primary enforcement body with the CPPA, added the category of sensitive personal information, created new consumer rights (correction and limit use of sensitive PI), expanded the definition of "sharing" for cross-context behavioral advertising, and introduced requirements for data processing agreements.
A business is subject to CCPA/CPRA if it:
Liberty Commerce Inc. Assessment: Liberty Commerce Inc., with annual revenues of $48 million and processing personal information of approximately 320,000 California consumers through its e-commerce platform, meets threshold (1) and threshold (2). Liberty Commerce Inc. is classified as a "business" under §1798.140(d).
Information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Categories include:
| Category | Examples |
|---|---|
| Identifiers | Real name, alias, postal address, unique personal identifier, online identifier, IP address, email, account name, SSN, driver's license, passport number |
| Commercial Information | Records of personal property, products or services purchased, obtaining, or considered |
| Biometric Information | Physiological, biological, or behavioral characteristics used to establish individual identity (fingerprint, face, voice, iris, keystroke patterns) |
| Internet/Network Activity | Browsing history, search history, information regarding interaction with website, application, or advertisement |
| Geolocation Data | Physical location or movements |
| Sensory Data | Audio, electronic, visual, thermal, olfactory, or similar information |
| Professional/Employment | Current or past job-related information |
| Education Information | Non-publicly available education records per FERPA (20 U.S.C. §1232g) |
| Inferences | Profiles reflecting preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, aptitudes |
| Sensitive PI (CPRA) | SSN/driver's license/passport, account log-in with password, precise geolocation, racial/ethnic origin, religious/philosophical beliefs, union membership, contents of mail/email/text, genetic data, biometric data for identification, health information, sex life/sexual orientation data |
Selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer's personal information by the business to a third party for monetary or other valuable consideration.
Sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating a consumer's personal information by the business to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, including situations where no money is exchanged.
| Aspect | Service Provider | Contractor |
|---|---|---|
| Definition | Processes PI on behalf of business per written contract | Processes PI made available by business per written contract |
| Contract Requirements | Written agreement prohibiting selling/sharing, limiting use to specified purposes | Written agreement with same prohibitions plus certification of understanding, grant of compliance audit rights |
| Subcontracting | May engage subcontractors with written contract | May engage subcontractors with written contract and business notification |
| Compliance Audits | Not expressly required in statute | Business has right to audit contractor compliance |
Consumers may request that a business disclose:
Lookback period: 12 months preceding the request (business may voluntarily go beyond).
Liberty Commerce Inc. Implementation: Liberty Commerce Inc. provides a "Know My Data" portal at privacy.libertycommerce.com/know where verified consumers can request all five categories of disclosure. The system generates a structured report in machine-readable format (JSON) and human-readable format (PDF) within 10 business days.
Consumers may request deletion of personal information collected from them. Upon receiving a verified request, the business must delete the PI and direct service providers and contractors to delete the consumer's PI.
Exceptions (§1798.105(d)): Transaction completion, security, error repair, free speech (Cal. Civ. Code §1798.105(d)(4)), internal uses reasonably aligned with consumer expectations, compliance with legal obligation, internal uses compatible with the context of collection.
Liberty Commerce Inc. Implementation: Liberty Commerce Inc. processes deletion requests through a cascading deletion workflow that propagates to all service providers (payment processor, shipping partner, analytics provider) within 45 calendar days. Retained data for legal compliance (tax records per 26 U.S.C. §6001) is documented with the specific legal basis.
Consumers may request correction of inaccurate personal information. The business must use commercially reasonable efforts to correct the information.
Liberty Commerce Inc. Implementation: Liberty Commerce Inc. allows consumers to self-correct profile data (name, address, email, phone) directly in their account. For data in backend systems (purchase history corrections, loyalty points), verified requests are processed through the privacy team with documentation of the correction.
Consumers have the right to direct a business that sells or shares their personal information to stop selling or sharing that information. The business must respect this direction.
Key requirements:
Liberty Commerce Inc. Implementation:
Liberty Commerce Inc. displays a persistent "Do Not Sell or Share My Personal Information" link in the footer of every page. The system detects GPC signals via the Sec-GPC: 1 HTTP header and navigator.globalPrivacyControl JavaScript API, automatically applying opt-out status to the browsing session and associating it with the consumer's account if authenticated.
Consumers may direct a business to limit its use of sensitive personal information to specified purposes (performing services/providing goods, preventing security incidents, resisting malicious/deceptive actions, ensuring safety, short-term transient use, performing services on behalf of the business, verifying/maintaining quality, upgrading/enhancing services).
Liberty Commerce Inc. Implementation: Liberty Commerce Inc. displays a "Limit the Use of My Sensitive Personal Information" link adjacent to the opt-out link. When activated, the system restricts processing of sensitive PI categories (precise geolocation, racial/ethnic origin data from surveys, payment card details beyond transaction processing) to the enumerated permitted purposes.
A business may not discriminate against a consumer for exercising their CCPA rights, including by:
Financial incentive programs are permitted if the consumer is notified and opts in, the incentive is reasonably related to the value of the consumer's data, and the business can explain the valuation methodology.
The privacy notice must be updated at least once every 12 months and include:
Liberty Commerce Inc. Implementation: Liberty Commerce Inc. publishes its California Privacy Notice at privacy.libertycommerce.com/california, updated annually in January. The notice uses a layered format with a summary table followed by detailed sections. Retention periods are specified per data category (e.g., transaction records: 7 years per tax requirements; browsing data: 13 months; account data: duration of account plus 30 days).
Businesses must enter into agreements with service providers, contractors, and third parties that:
A business's collection, use, retention, and sharing of PI must be:
| Requirement | Detail |
|---|---|
| Response deadline | 45 calendar days from receipt of verifiable request |
| Extension | Up to 45 additional days (90 total) with notice to consumer |
| Verification | Reasonable methods to verify identity; match at least two data points for access; three data points for specific pieces |
| Authorized agents | Must accept requests from authorized agents with signed permission or power of attorney |
| Free requests | At least two free requests per 12-month period |
| Format | Delivered in readily usable, machine-readable format (for portability requests) |
| Toll-free number | Required for businesses that operate exclusively online only if they have a direct relationship with the consumer |
Businesses that buy, receive, or sell the PI of 10,000,000 or more consumers must compile metrics for the prior calendar year and disclose:
Limited to data breach claims where nonencrypted and nonredacted PI (as defined in Cal. Civ. Code §1798.81.5(d)(1)(A)) is subject to unauthorized access due to the business's failure to implement reasonable security measures.