Skip to content
PrivacyBuilt

Intermediate

CCPA/CPRA and US State Privacy Operations

Build a repeatable US state privacy operating model using California as the anchor and reusable controls for rights, opt-outs, sensitive data, vendors and assessments.

5 hours9 modules8 lessonsFree certificate

About this course

A practitioner course for teams that must run consumer privacy operations across multiple United States state laws without rebuilding the programme for each one. California is used as the anchor because it is the most detailed regime, and each module produces a reusable control: an applicability matrix, a notice inventory, a rights workflow, an opt-out and preference-signal design, a supply-chain contract standard, an assessment method and a monitoring calendar. The course is an operational comparison, not an exhaustive fifty-state legal opinion.

What you will be able to do

  • Determine when major US state consumer privacy laws may apply without assuming one universal threshold
  • Implement notices and consumer-rights workflows that support jurisdictional differences
  • Operationalise sale, sharing, targeted-advertising and profiling opt-outs, including recognised preference signals where required
  • Govern sensitive data, children's data, service providers, contractors and third parties
  • Maintain an evidence-based multi-state control matrix for assessments, cybersecurity obligations and enforcement readiness

Course content

  1. 1

    The US privacy map and applicability method

    Work out which state comprehensive laws may reach an activity, and where sectoral rules and exemptions change the answer.

    • The US privacy map and applicability method35 min

    4-question quiz

  2. 2

    California foundation

    Get the California terminology, roles and notice duties right before scaling anything to other states.

    • California foundation: CCPA/CPRA terminology and notice basics35 min

    4-question quiz

  3. 3

    Rights-request operations

    Run access, deletion, correction, portability and authorised-agent requests with proportionate verification.

    • Rights-request operations across states35 min

    4-question quiz

  4. 4

    Sale, sharing, targeted advertising and preference signals

    Separate four concepts that are often conflated, and design opt-outs and signal handling that hold up.

    • Sale, sharing, targeted advertising and preference signals35 min

    4-question quiz

  5. 5

    Sensitive data and children

    Apply limitation and consent approaches to sensitive categories and escalate age-related processing safely.

    • Sensitive data and children: limitation and consent approaches30 min

    4-question quiz

  6. 6

    Contracts and data supply chains

    Set contract terms and downstream controls for service providers, contractors and third parties.

    • Contracts and data supply chains30 min

    4-question quiz

  7. 7

    ADMT, profiling, risk assessments and cybersecurity audits

    Work through California final regulations effective 1 January 2026 and the recurring assessment patterns in other states.

    • ADMT, profiling, risk assessments and cybersecurity audits35 min

    4-question quiz

  8. 8

    Multi-state implementation workshop

    Build the applicability, rights, opt-out, assessment and evidence matrices and the change-control routine that keeps them current.

    • Multi-state implementation workshop35 min

    4-question quiz

  9. 9

    Final AssessmentFinal assessment

    Confirm your understanding across the full course.

    10-question final assessment