ISMS Copilot
CCPA / CPRA

CCPA / CPRA Copilot

Specialist AI guidance for California consumer privacy law

Try it freeSee it in action

What the CCPA / CPRA Copilot Can Do

Applicability assessment against CCPA/CPRA business thresholds

Privacy notice and Notice at Collection drafting (Cal. Civ. Code §1798.100, §1798.130)

Consumer rights workflow design: Know, Delete, Correct, Opt-Out, Limit Sensitive PI

Service Provider and Contractor agreement review (§1798.100(d))

Sensitive Personal Information classification and limit-use guidance (§1798.121)

Cross-mapping to GDPR for businesses already running an EU privacy program

About CCPA / CPRA Copilot

CCPA / CPRA Copilot helps US and global businesses subject to the California Consumer Privacy Act (as amended by the California Privacy Rights Act) build compliant privacy programs, draft consumer-rights workflows, and align California obligations with their existing GDPR program.

Who it's for

GDPR

The European analogue — different lawful-basis model but overlapping data-subject rights.

ISO 27701

Certification-grade evidence of the privacy controls CCPA's reasonable security duty implies.

HIPAA

CCPA exempts most HIPAA-covered information — knowing the boundary is half the work.

Cross-framework mappings

Working across CCPA / CPRA and another standard? ISMS Mappings is a free public directory of control maps (ISO 27001, SOC 2, NIST, GDPR, and more). A Better ISMS tool, separate from the chat assistant.

Browse free mappings

Frequently Asked Questions

Who must comply with CCPA / CPRA?

For-profit businesses that do business in California, collect California consumer personal information, determine purposes and means, and meet any one threshold: worldwide annual gross revenue over $26.625 million (the CPPA inflation-adjusted figure in force since 1 January 2025), 100,000+ California consumers or households whose PI is bought, sold, or shared, or 50%+ of revenue from selling or sharing that PI. The free checker at /resources/ccpa-applicability-checker runs that definition as a structured assessment.

How is CCPA different from GDPR?

CCPA is opt-out (sale/sharing) where GDPR is opt-in (most processing). CCPA grants consumer rights similar to GDPR data subject rights but uses different terminology ('consumer' vs 'data subject', 'business' vs 'controller'). The Copilot translates between the two so you can run one program across both jurisdictions.

Does CPRA replace CCPA?

CPRA amends and expands CCPA — it did not replace it. Together they form the current California consumer privacy framework, enforced by the California Privacy Protection Agency (CPPA). The Copilot covers the consolidated requirements.

Ready to do compliance work faster?

Built for speed, accuracy, and audit-ready output.

Try ISMS Copilot