- 01Right-to-correct is harder than right-to-delete: deletion is one-time, correction must propagate consistently across every system holding the consumer's record. Manual correction does not scale.
- 02The fix is a canonical 'consumer record' service that downstream systems query or sync from, with documented exceptions for systems that legitimately retain pre-correction values (audit, billing, legal hold).
- 03CPRA's Sensitive PI category (precise geolocation, government IDs, biometrics, health, sex life, etc.) requires a right-to-limit-use. Implement as a tagging discipline at the data-classification layer, not a per-process workflow.
- 04California AG enforcement has repeatedly focused on third-party advertising trackers and the 'sale'/'share' definition. A tag audit and an honest analysis of which integrations qualify is the highest-priority gap for most consumer businesses.
After three years of California Consumer Privacy Act (and the CPRA amendments) in operation, the patterns of enforcement and operational pain are clear. The compliance burden is not where most programs first looked.
Right to correct is harder than right to delete
Deletion is a one-time operation; correction requires you to identify every system holding the consumer's data and apply the correction consistently. Most data architectures were not designed for this, and the workaround — manual correction across systems — does not scale.
The fix is a canonical 'consumer record' service that downstream systems either query or sync from, with documented exceptions for systems that legitimately retain pre-correction values (audit, billing, legal hold).
Sensitive Personal Information
CPRA's Sensitive PI category (precise geolocation, government IDs, racial/ethnic origin, religious or philosophical beliefs, contents of mail/email/text messages not directed to the business, genetic data, biometrics for unique identification, health information, and sexual orientation/sex life) requires consumer rights to limit use.
Implement this as a tagging discipline at the data-classification layer, not as a per-process workflow.
The ad-tech reality
California Attorney General enforcement actions have repeatedly focused on third-party advertising trackers and the 'sale' definition. If you have not done a tag audit and an honest analysis of which integrations constitute a 'sale' or 'share,' that is the highest-priority gap.