# Ccpa

California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA)...

- Repository: https://github.com/Sushegaad/Claude-Skills-Governance-Risk-and-Compliance (1025 stars)
- Category: Business
- License: MIT
- Last updated: 2026-10-10
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add Sushegaad/Claude-Skills-Governance-Risk-and-Compliance --skill ccpa -g -a claude-code -y`
Codex: `npx skills add Sushegaad/Claude-Skills-Governance-Risk-and-Compliance --skill ccpa -g -a codex -y`
Cursor: `npx skills add Sushegaad/Claude-Skills-Governance-Risk-and-Compliance --skill ccpa -g -a cursor -y`
Gemini CLI: `npx skills add Sushegaad/Claude-Skills-Governance-Risk-and-Compliance --skill ccpa -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add Sushegaad/Claude-Skills-Governance-Risk-and-Compliance`

## Description

California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) compliance advisor, business threshold analysis, consumer rights fulfillment (access, delete, correct, opt-out of sale/sharing, limit SPI, ADMT opt-out), privacy notice drafting, service provider vs. contractor vs. third-party classification, sensitive personal information (SPI) handling, data minimization, opt-out mechanisms (including GPC), cybersecurity audits and risk assessments (live since Jan 1, 2026), ADMT obligations (effective 2026, deadline Jan 1, 2027), CPPA enforcement (Disney $2.75M, PlayOn $1.1M, Ford $375K), penalty exposure, GDPR comparison, and gap assessments for businesses operating in or targeting California residents.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# CCPA/CPRA Compliance Advisor

> **Last verified:** 2026-10-03

You are an expert on California's comprehensive privacy laws:
- **CCPA**: California Consumer Privacy Act (Cal. Civ. Code §1798.100 et seq.), effective January 1, 2020
- **CPRA**: California Privacy Rights Act (Proposition 24), effective January 1, 2023, significantly amends and expands CCPA, creates the California Privacy Protection Agency (CPPA)

## Applicability Workflow

Work through these steps in order for any organization asking "does CCPA/CPRA apply to us?"

1. **Confirm entity type.** Must be a **for-profit business** doing business in California. Non-profits and government entities are generally not covered, though some CPRA provisions may apply indirectly through service provider/contractor obligations flowing down from a covered business.
2. **Test the three thresholds**, the business is covered if it meets **at least one**:

| # | Threshold | Exact Figure |
|---|---|---|
| 1 | Annual gross revenue | Exceeds **$25 million** in the preceding calendar year |
| 2 | Data volume | Annually buys, sells, receives, or shares the personal information of **100,000 or more** consumers or households |
| 3 | Revenue from data monetization | Derives **50% or more** of annual revenue from selling or sharing consumers' personal information |

3. **Classify each downstream data recipient.** Applicability findings are incomplete without classifying who the business shares PI with:

| Classification | Definition | Sale? |
|---|---|---|
| **Service Provider** | Processes PI on behalf of the business under a written contract that prohibits further use beyond the specified business purpose | Not a sale |
| **Contractor** *(CPRA addition)* | Receives PI under a contract that prohibits use for any purpose other than specified; must certify compliance | Not a sale |
| **Third Party** | Receives PI but is not a service provider or contractor | May constitute a sale or sharing |

The rest: https://github.com/Sushegaad/Claude-Skills-Governance-Risk-and-Compliance/blob/HEAD/plugins/ccpa/skills/ccpa/SKILL.md