CCPA/CPRA vs VCDPA vs CPA

The US State Privacy Patchwork

The United States lacks a comprehensive federal privacy law, leaving individual states to create their own frameworks. California (CCPA/CPRA), Virginia (VCDPA), and Colorado (CPA) represent the three most influential state privacy laws and serve as models for the growing number of states enacting similar legislation.

Threshold Differences Matter for Mid-Market Companies

CCPA has the broadest reach because it includes a revenue threshold ($26.625M) as an alternative trigger. A company can fall under CCPA solely based on revenue, even if it processes relatively little California consumer data. VCDPA and CPA have no revenue threshold — they focus purely on data processing volume.

For mid-market companies with under 200 employees, the consumer threshold (100,000+) is the most common trigger across all three laws. If you operate a B2C service with customers in these states, you likely hit this threshold.

Penalties: Colorado Leads

Colorado's CPA has the highest per-violation penalty at $20,000, compared to $7,988 (CCPA) and $7,500 (VCDPA). However, CCPA is the only one with a private right of action for data breaches, which means individual consumers can sue for $100-$750 per person per incident — potentially resulting in far higher total liability for data breach events.

Universal Opt-Out: A Key Differentiator

Both CCPA and CPA require businesses to honor universal opt-out mechanisms like the Global Privacy Control (GPC) browser signal. VCDPA does not require this. For companies building opt-out infrastructure, this means you need technical implementations that detect and honor GPC signals for California and Colorado visitors.

Cure Periods Are Disappearing

Initially, all three laws offered cure periods — time to fix a violation before enforcement action. CCPA eliminated its cure period with the CPRA amendments. Colorado's cure period expired in January 2025. Only VCDPA retains a 60-day cure period, but this is expected to be shortened in future amendments. The trend is clear: businesses should proactively comply rather than relying on cure periods.

Building Multi-State Compliance

For mid-market companies operating across multiple US states: (1) implement a universal opt-out mechanism (covers CCPA and CPA), (2) build DSAR workflows to meet the 45-day deadline consistently, (3) create state-specific privacy notices where required, (4) implement cookie consent and tracking preference controls, and (5) monitor new state laws — over 15 US states have now enacted comprehensive privacy legislation.