CCPA/CPRA Technical Mechanics
Unlike the GDPR's opt-in focus, California's privacy laws revolve around explicit opt-out mechanisms and rigorous response windows.
The 45-Day Countdown
When a Californian consumer submits a Data Subject Access Request (DSAR), the clock starts. You have 45 days (with a possible 45-day extension) to verify their identity, locate their data across all microservices, and deliver it securely.
In 2022, Sephora was fined $1.2M for failing to process "Global Privacy Control" (GPC) signals. Your API gateway must parse HTTP headers for `Sec-GPC: 1`.
| Signal | Source | Required Backend Action |
|---|---|---|
| Sec-GPC Header | Browser (e.g., Brave) | Flag session as `do_not_sell=true`, block third-party pixels. |
| Do Not Track (DNT) | Legacy Browser | Largely deprecated, but honoring it reduces regulatory friction. |
| Opt-Out Link | Footer UI | Set permanent JWT claim preventing data brokering. |
Tool: DSAR Response Deadline Calculator
Common Mistakes: Identity Verification
Do not ask a user to create an account just to submit a deletion request. Conversely, do not blindly delete an account because an email was received from a spoofed address. You must send a cryptographic nonce (a magic link) to the email on file to verify ownership.
FAQ
Explore Architecture Requirements
- GDPR Engineering
- Encryption At Rest & In Transit
- Automated Data Mapping
- Implementing Right to Erasure
- Data Portability JSON Exports
- Consent Management Architecture
- Automated Breach Response
- Cross-Border Data Transfers
- DSAR Automation Pipelines
- Catastrophic Cryptography Fails
- Database Deletion Workflows
- Gating Third-Party Scripts
- Auth via Identity Providers
- Cookie Banner Compliance
- Vendor & Subprocessor Risk
- API Privacy & Security
- End-to-End Encryption (E2EE)
- Log Retention
- Cloud Compliance
- DPO Specs
- Homepage