CIPP-US - State Privacy Laws (23% of the exam) - Section 5.2

Apply the California Consumer Privacy Act as amended by the California Privacy Rights Act, including consumer rights, business obligations, and opt-out mechanisms.

Apply the CCPA as amended by the California Privacy Rights Act to identify consumer rights, including access, deletion, correction, portability, and opt-out of sale or sharing, and the matching business duties for notices, response timelines, and service-provider contracts. Distinguish opt-out of sale from the right to limit sensitive personal information, and note the CPPA enforcement role.

CCPACPRACalifornia Privacy Rights ActOpt-out of sale

Practice question for this objective

Free sampleState Privacy Lawshard

A California consumer contacts a covered retailer that collects her precise geolocation and her stored payment-card details. She wants to know which rights the CCPA as amended by the CPRA actually gives her over this data. Which two statements correctly describe rights the CCPA as amended grants her? (Select TWO.)

AShe may compel the retailer to obtain her opt-in consent before it collects any sensitive personal information from her at all.
BShe may request that the retailer correct inaccurate personal information it maintains about her, taking account of its nature and purpose. Correct
CShe may bring a private lawsuit against the retailer for any violation of her access, correction, or deletion rights under the statute.
DShe may direct the retailer to limit its use and disclosure of her precise geolocation to what is necessary to provide the requested goods or services. Correct
EShe may demand deletion of all personal information the retailer holds with no exception, including data the retailer needs to complete her pending transaction.

The CCPA as amended by the CPRA grants California consumers both a right to correct inaccurate personal information and a right to limit the use of sensitive personal information. The CPRA introduced both a correction right and a right to limit the use of sensitive personal information, which operates as a post-collection opt-out rather than a pre-collection opt-in. The opt-in framing belongs to the other states, the private right of action reaches only qualifying breaches, and deletion carries statutory exceptions, so those three options are wrong.

Why A is wrong: Opt-in consent before collecting sensitive data is the Virginia, Colorado, and Connecticut approach; California instead gives a right to limit use after collection, so this misattributes another model's rule.

Why B is correct: The CPRA added an express right to correct inaccurate personal information, requiring commercially reasonable efforts to fix it given the data's nature and the processing purpose.

Why C is wrong: Tempting because the CCPA has a private right of action, but that action is confined to certain breaches caused by unreasonable security, not to general rights violations, which the CPPA and Attorney General enforce.

Why D is correct: Precise geolocation is sensitive personal information, so the right to limit lets the consumer cap its use and disclosure to what is reasonably necessary to deliver the service she requested.

Why E is wrong: The deletion right is real, but it is subject to enumerated exceptions such as completing a transaction the consumer requested, so an absolute no-exception deletion right overstates the law.

See more CIPP-US practice questions, answers explained.

Exam traps in State Privacy Laws

Answers that look right on this material and are not. Each one is a distractor from a different question in the CIPP-US bank for this domain.

It must obtain each consumer's affirmative opt-in consent before it may sell or share that consumer's personal information for behavioural advertising.
Why it is wrong: Tempting because Virginia, Colorado and Connecticut require opt-in consent, but only before processing sensitive data. For sale and targeted advertising those states use an opt-out model, and so does California for the sale and sharing of adults' personal information.
The right to correct, which obliges the business to amend inaccurate precise geolocation records on file.
Why it is wrong: Correction addresses inaccurate personal information, but the consumer here is objecting to how accurate data is used, so the correction right does not match the request.
Providing a single clear and conspicuous 'Do Not Sell or Share My Personal Information' link, and either honouring opt-out preference signals or offering a second opt-out method such as a request form.
Why it is wrong: This is tempting and close, but the regulations require honouring opt-out preference signals; a business cannot treat the signal as merely one of two interchangeable options it may decline in favour of a form.

Examworthy is not affiliated with or endorsed by IAPP. Original, blueprint-aligned practice material only.