Ccpa Compliance

CCPA/CPRA Compliance

Assess and implement CCPA/CPRA compliance for "$ARGUMENTS". Determine applicability, map consumer rights procedures, define notice requirements, and establish service provider agreements.

Note: AI-generated legal content does not constitute legal advice. Consult a qualified attorney.

Prerequisites

Check that .metapowers/legal/$ARGUMENTS/00-assess.md exists. If it does not exist, stop and tell the user:

"Run an Assess skill first (e.g. /legal:risk-assessment $ARGUMENTS) to generate the prerequisite assessment artifact."

If the user passes --skip-checks, bypass this check and log the skip to .metapowers/legal/$ARGUMENTS/skip-log.md with a timestamp and the reason "Prerequisite check skipped for ccpa-compliance".

Process

1. Read inputs:

   • Read .metapowers/legal/$ARGUMENTS/00-assess.md for risk, jurisdiction, and data practice context
   • Read any existing draft or review artifacts in .metapowers/legal/$ARGUMENTS/ for additional context

2. Determine CCPA applicability:

   • Annual gross revenue exceeds $25 million
   • Annually buys, sells, or shares personal information of 100,000 or more consumers, households, or devices
   • Derives 50% or more of annual revenue from selling or sharing consumers' personal information
   • Document which threshold(s) are met or potentially met

3. Map consumer rights procedures:

   • Right to know (categories and specific pieces of personal information collected, sold, or disclosed) — verification procedures, response timeline (45 days, extendable by 45)
   • Right to delete — verification procedures, exceptions (complete transaction, security, legal obligation, etc.), service provider notification requirements
   • Right to opt-out of sale/sharing — mechanism for submitting opt-out requests, Global Privacy Control signal recognition
   • Right to correct — process for submitting and verifying correction requests
   • Right to limit use of sensitive personal information — categories of sensitive PI, link to limit use, processing restrictions
   • Designated methods for submitting requests (at minimum: toll-free number and website)

4. Notice at collection requirements:

   • Categories of personal information collected
   • Purposes for each category
   • Whether personal information is sold or shared
   • Retention period per category
   • Link to full privacy policy

5. Service provider vs. contractor agreements:

   • Distinguish service provider, contractor, and third-party roles
   • Required contractual provisions for service providers (prohibit selling/sharing, limit use to contracted purpose, compliance obligations, grant audit rights)
   • Required contractual provisions for contractors (same as service providers plus certification requirements)

6. Financial incentive disclosures:

   • Identify any loyalty programs, discounts, or price differences tied to personal information
   • Document the value of consumer data and methodology
   • Notice and opt-in consent requirements

7. Do-not-sell/share link requirements:

   • Clear and conspicuous "Do Not Sell or Share My Personal Information" link on homepage
   • Alternative opt-out link if using unified approach
   • Technical implementation requirements

8. Data retention schedules:

   • Define retention periods per category of personal information
   • Justify retention periods based on business necessity
   • Document deletion or de-identification procedures

9. Employee and B2B data obligations:

   • Full CCPA rights now apply to employee, applicant, and B2B data
   • Document handling procedures for these categories
   • HR and recruitment process compliance

10. Privacy policy requirements specific to CCPA:

    • Categories of personal information collected, sold, and shared in preceding 12 months
    • Categories of sources and third parties
    • Business or commercial purpose for collection
    • Consumer rights description and how to exercise them
    • Annual update requirement

11. Write the artifact to .metapowers/legal/$ARGUMENTS/03-comply.md with frontmatter:

    ---
    description: CCPA/CPRA compliance assessment for $ARGUMENTS
    ---
    

    Include sections:

    • Applicability Determination — threshold analysis
    • Consumer Rights Procedures — detailed procedures for each right
    • Notice at Collection — required disclosures
    • Service Provider/Contractor Agreements — contractual requirements
    • Financial Incentives — disclosures and opt-in requirements
    • Do-Not-Sell/Share Implementation — link and mechanism requirements
    • Data Retention Schedule — per-category retention periods
    • Employee/B2B Data — handling procedures
    • Privacy Policy Updates — CCPA-specific content requirements
    • Compliance Gaps — identified gaps with remediation recommendations

Output

The CCPA/CPRA compliance assessment written to .metapowers/legal/$ARGUMENTS/03-comply.md. Present a summary to the user highlighting:

• Whether CCPA applies and which thresholds are triggered
• Consumer rights procedures defined
• Notice and disclosure requirements identified
• Service provider agreement requirements
• Critical compliance gaps requiring immediate attention