CCPA

CCPA Advanced

Name: eurocompliant.com AI Compliance Copilot
Price: 299 EUR
Author: eurocompliant.com

Complex CCPA/CPRA scenarios: enforcement risk, cross-border considerations, and interaction with other US privacy laws.

11 questions · 80% to pass · free

eurocompliant.com is not an accredited certification body. This is a self-paced educational assessment; the certificate confirms completion only, not a professional, statutory, or accredited qualification.

Your details

Name *

Email *

We'll email your certificate here if you pass. We may occasionally follow up about eurocompliant.com - you can unsubscribe any time.

Question 1 of 11

How does the CPPA's rulemaking and enforcement authority relate to the California Attorney General's role under the CCPA?

Both the CPPA and the Attorney General have roles in enforcement, with the CPPA also holding rulemaking authorityOnly the CPPA may enforce; the Attorney General has no roleThe Attorney General lost all authority once the CPPA was createdOnly the Attorney General may ever enforce the law, with no CPPA role

Question 2 of 11

A business inadvertently sells personal information to a data broker without proper contractual restrictions. What CCPA classification issue does this raise?

The transfer is automatically illegal regardless of any contractWithout a compliant contract restricting the recipient's use, the transfer risks being classified as a 'sale' rather than a service-provider disclosure, triggering additional obligations (e.g. opt-out rights)None — any transfer is automatically treated as a service provider relationshipCCPA does not apply to data brokers under any circumstances

Question 3 of 11

Which of the following are examples of 'dark patterns' that CCPA/CPRA rulemaking has specifically sought to prohibit in opt-out/consent flows?

Select all that apply.

A single, clearly labeled 'Do Not Sell or Share' linkRequiring consumers to click through multiple confusing screens to exercise a rightUser interfaces designed to subvert or impair a consumer's choice to opt outMaking the opt-out process more difficult than the opt-in process

Question 4 of 11

A multistate business operates under both the CCPA and a comparable state law (e.g. Virginia's VCDPA). What is a key practical challenge this creates?

Businesses may simply ignore whichever law is less strictNo challenge — all US state privacy laws are identicalReconciling differing definitions, thresholds, and consumer rights mechanics across states while maintaining a single compliant programState privacy laws are pre-empted entirely by CCPA nationwide

Question 5 of 11

Under CCPA regulations, what must a business do if it cannot verify a consumer's identity for a deletion request but the request appears to relate to information the business does hold?

Report the consumer to law enforcementIgnore the request entirely with no responseAutomatically delete the data regardless of verificationDeny the request but generally still offer another right, such as opt-out of sale/sharing, where verification is not required to the same degree

Question 6 of 11

How does the CCPA's 'right to correct' (added by the CPRA) interact with a business's obligation regarding data accuracy?

There is no right to correct under the CCPAIt only applies to information a business itself entered, not third-party-sourced dataIt requires businesses to use commercially reasonable efforts to correct inaccurate personal information upon a verified consumer requestIt replaces the right to delete entirely

Question 7 of 11

A business relies on 'aggregate consumer information' and 'de-identified' data to avoid certain CCPA obligations. What condition must generally be met for data to qualify as de-identified?

De-identification has no defined standard under the CCPAThe data must be encrypted only, with no other safeguard neededInformation cannot reasonably identify, relate to, or be linked with a particular consumer, and the business takes reasonable measures (including contractual and technical) to ensure it stays that waySimply removing a person's name is always sufficient

Question 8 of 11

What is the significance of the CCPA's private right of action being limited primarily to certain data breach scenarios, rather than covering all CCPA violations?

It means no consumer can ever sue over a CCPA issueGeneral CCPA violations are primarily enforced by the CPPA/Attorney General rather than through broad consumer litigation, unlike the qualifying breach scenarioIt means data breaches themselves cannot be litigated at allIt has no practical significance for business risk assessment

Question 9 of 11

Which of the following are relevant considerations for a business conducting a CPRA-mandated cybersecurity audit or risk assessment for processing that presents significant risk?

Select all that apply.

The business's marketing sloganPotential risks to consumer privacy and mitigating safeguardsWhether sensitive personal information or automated decision-making is involvedThe scope and purpose of the processing activity

Question 10 of 11

Contractual flow-down obligations mean a business remains responsible for ensuring its service providers and contractors process personal information consistently with CCPA restrictions, even though the service provider is directly bound by contract.

TrueFalse

Question 11 of 11

How should a business approach 'sharing' of personal information for cross-context behavioral advertising under the CPRA, distinct from a traditional 'sale'?

'Sharing' is legally identical to 'sale' and requires no separate analysisSharing only applies to nonprofit organizationsSharing is entirely unregulated under California law'Sharing' captures certain cross-context behavioral advertising disclosures even without monetary exchange, and separately triggers opt-out rights alongside 'sale'

0 of 11 answered