Features For Organisations For Professionals How It Works Pricing Docs Blog

CCPA

CCPA Practitioner

Name: eurocompliant.com AI Compliance Copilot
Price: 299 EUR
Author: eurocompliant.com

Applying CCPA/CPRA in practice: verifiable requests, service provider contracts, and notice obligations.

13 questions · 75% to pass · free

eurocompliant.com is not an accredited certification body. This is a self-paced educational assessment; the certificate confirms completion only, not a professional, statutory, or accredited qualification.

Your details

Name *

Email *

We'll email your certificate here if you pass. We may occasionally follow up about eurocompliant.com - you can unsubscribe any time.

Question 1 of 13

Under Sections 1798.130/1798.135, what must a business do when it receives a request to know or delete?

Verify the requester's identity to a reasonable degree of certainty before responding, using a reasonable methodIgnore requests that arrive by phoneCharge a mandatory fee to process every requestAutomatically deny the first request received from any consumer

Question 2 of 13

What is the general timeframe within which a business must respond to a verifiable consumer request?

45 days, generally extendable once by an additional 45 days with noticeOne calendar yearThere is no deadlineImmediately, with no exceptions

Question 3 of 13

Which of the following disclosures must generally be included in a CCPA-compliant privacy notice at or before collection?

Select all that apply.

The business's unrelated internal salary bandsWhether the information is sold or shared, and consumers' rightsThe purposes for which the categories will be usedThe categories of personal information to be collected

Question 4 of 13

What distinguishes a 'service provider' from a 'third party' under the CCPA?

A service provider processes personal information on the business's behalf under a contract restricting use to specified business purposesA service provider is always the governmentThere is no distinction — the terms are interchangeableA third party always has fewer restrictions than a service provider

Question 5 of 13

What must a CCPA-compliant contract with a service provider generally prohibit?

Charging for services renderedNothing — no specific contractual terms are requiredThe service provider retaining, using, or disclosing personal information for any purpose other than the specified business purposes in the contractThe service provider ever accessing any data at all

Question 6 of 13

Under the CPRA's amendments, what right did consumers gain regarding automated decision-making technology?

Rights related to access and opt-out concerning businesses' use of automated decision-making technology, as further defined through CPPA rulemakingAn absolute ban on all automated processingNo new rights were introduced regarding automated decision-makingThe right to personally reprogram a business's algorithms

Question 7 of 13

Under the CCPA, a business's employees and job applicants were, at least for a transitional period, treated differently from ordinary 'consumers' for certain purposes, reflecting a distinct employment-context carve-out.

TrueFalse

Question 8 of 13

What is the CCPA's general position on collecting more personal information than needed for the disclosed purpose (data minimization, as strengthened by the CPRA)?

Minimization only applies to financial dataMinimization only applies to government agenciesCollection and use should be reasonably necessary and proportionate to the disclosed purposesThere is no limitation — businesses may collect unlimited data

Question 9 of 13

If a consumer opts out of the sale/sharing of their personal information, for how long must the business generally honor that opt-out before it may ask again?

Opt-outs never need to be honored if inconvenientOpt-outs expire automatically after 24 hoursThe business may ask again immediately, repeatedlyThe business generally may not ask the consumer to opt back in for a set period (commonly referenced as around 12 months) without explicit request

Question 10 of 13

What is a 'global privacy control' (GPC) signal, as recognized under CCPA guidance/rulemaking?

A government ID numberA physical off-switch on a routerA type of encryption algorithmA browser or device-level signal a consumer can use to communicate an opt-out preference to businesses, which businesses must generally honor

Question 11 of 13

What obligation applies to a business regarding minors under 16 and the sale or sharing of their personal information?

No special rules apply to minorsOnly minors over 18 have any rightsMinors are entirely excluded from CCPA protectionOpt-in consent is generally required (from the minor aged 13-15, or a parent/guardian for those under 13) before selling or sharing their personal information

Question 12 of 13

Under the CCPA, 'publicly available information' lawfully made available from government records is entirely excluded from the definition of personal information, subject to the statutory conditions.

TrueFalse

Question 13 of 13

What is the purpose of a Data Protection Assessment as introduced by CPRA rulemaking for certain high-risk processing?

To evaluate and document risks associated with processing activities such as those involving sensitive personal information or automated decision-makingIt replaces the need for any privacy noticeIt is a purely voluntary marketing exercise with no compliance relevanceIt only applies to healthcare businesses

0 of 13 answered

eurocompliant.com

Compliance automation built by cybersecurity experts.

Product

Features
For Organisations
For Professionals
Pricing
Security

Resources

Docs
Blog
How It Works
Security FAQ
Legislation
Sample Docs

Legal

Company

About Us
Careers
Contact Us
info@eurocompliant.com

This platform provides compliance tools and information for general guidance only. It does not constitute legal advice. Consult a qualified legal professional for advice specific to your organisation.