Many believe California's privacy laws, the CCPA and CPRA, set the standard for U.S. privacy regulation. The idea is that if you align with California's requirements, you're prepared for other states. This belief is echoed by legal counsel, vendors, and privacy officers.
However, this approach is misleading and potentially risky.
Why the Blueprint Narrative Breaks Down
California's privacy laws are unique, making them a poor template for a broader compliance strategy. They reflect specific political compromises and consumer expectations that don't easily apply elsewhere.
Consider the structural differences. The CPRA established the California Privacy Protection Agency with rulemaking and investigative powers. Other states rely on attorney general enforcement, which varies in priorities and resources. For example, Colorado includes a mandatory cure period, unlike California. Virginia requires opt-in consent for sensitive data, but its definition of "sensitive" differs from California's.
The differences extend to specific requirements. California's "Do Not Sell or Share My Personal Information" link is based on a definition of "sale" that includes Behavioural Advertising. Connecticut and Utah have different approaches. If your Consent Management Platform is built around California's requirements, it won't be easily adaptable to other states.
The Evidence: Divergence, Not Convergence
Lothar Determann's "California Privacy Law" is now in its fifth edition, highlighting the state's unique demands. The CPRA's implementation, with pending regulations, creates ongoing challenges specific to California.
After CPRA, states like Virginia, Colorado, and Connecticut enacted laws with distinct mechanisms. Virginia's Consumer Data Protection Act, for instance, lacks a private right of action and includes a cure-period requirement. Each state chose to diverge from California based on local needs.
Internationally, the GDPR doesn't recognize California-style sale opt-outs, operating on a different foundation. China's Personal Information Protection Law has data localization requirements absent in California. Even Canada's proposed privacy bill diverges in its approach to consent and individual rights.
What to Do Instead
Build your compliance program around principles, not jurisdictions. Start with the strictest requirements across all applicable laws, then add jurisdiction-specific elements.
For consent management:
Map your legal basis by processing purpose, not geography. If you're involved in Behavioural Advertising under GDPR, ePrivacy Regulation, and U.S. state laws, determine a defensible legal basis. Prior consent under ePrivacy is stricter than CPRA's opt-out model. Design for the stricter standard and add California-specific controls as needed.
Separate your technical architecture from your legal compliance layer. Your CMP should capture granular consent at the purpose and vendor level, regardless of legal requirements. While California may only require category-level opt-outs, your consent records should meet GDPR's standards for specific consent. Build technical capabilities once and configure them for different legal obligations.
Track divergence actively. Maintain a matrix documenting how each law defines key terms like "sale," "share," "sensitive data," and "targeted advertising." Understanding these differences is crucial for compliance.
Design for the next law, not the last one. New laws in Montana and Oregon are on the horizon, each with unique variations. Federal legislation is also possible. Assuming California's approach is universal will lead to costly adjustments with each new law.
When California Really Does Lead
California's laws have set patterns in specific areas. Its breach notification law influenced other states, and the structure of individual rights has been widely adopted.
California's enforcement actions highlight compliance gaps that are relevant everywhere. When the California Privacy Protection Agency investigates issues like dark patterns in consent interfaces, those findings inform practices beyond California. The agency's rulemaking process often raises compliance questions that other regulators will eventually address.
For companies with significant operations in California, compliance with CPRA is essential. However, using California as a universal template creates blind spots. You'll miss important elements like Virginia's cure period and Colorado's opt-out requirements.
Focus on principles and adapt for jurisdictions. California is just one part of the privacy landscape, not the entire map.
