California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) compliance advisor — business threshold analysis, consumer rights fulfillment (access, delete, correct, opt-out of sale/sharing, limit SPI, ADMT opt-out), privacy notice drafting, service provider vs. contractor vs. third-party classification, sensitive personal information (SPI) handling, data minimization, opt-out mechanisms (including GPC), cybersecurity audits and risk assessments (live since Jan 1, 2026), ADMT o
SkillScore91Maintained
Automatic
◆Legal & Contracts pack
Last verified 10/9/2026
What it changes
Passed 21 of 23 test cases with the skill, and 12 of 23 without it.
Without skill52%
With skill91%
Checks it passed that the model alone missed
Notes that cybersecurity audit regulations became effective January 1, 2026.
Cites the 2.75 million dollar penalty assessed against The Walt Disney Company in 2026.
Specifies that revenue and data volume applicability thresholds must be reassessed annually.
and 9 more in the full report
9 fixed12 passed either way2 still failing0 broke
Pass-rate lift
+39 pp
Tokens
+201%
Agent turns
0%
Response time
-8%
Model gemini-3.6-flashMeasured 10/9/2026v221 of 23 cases passed with skill
Tokens, turns and time describe resource use, not a dollar price.
See it in action
One of 9 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 9
Prompt
Our e-commerce company is expanding operations into California and we need to evaluate whether we fall under state privacy regulation. Please provide a structured applicability assessment workflow. Specifically, format your response as a step-by-step evaluation guide that details the financial and data volume criteria we must analyze, followed by a classification table defining the categories of downstream data recipients and whether sharing data with each category triggers sale or sharing obligations.
What was checked, without and with the skill
Checked
Without skill
With skill
States that providers of cross-context behavioral advertising are classified as third parties regardless of contract terms.
Missed
Passed
Specifies that revenue and data volume applicability thresholds must be reassessed annually.
Missed
Passed
Includes the 25 million dollar annual gross revenue threshold.
Passed
Passed
Includes the 100,000 consumers or households threshold for data volume.
Passed
Passed
case-01 · gemini-3.6-flash · 10/9/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md279 lines3 files
CCPA/CPRA Compliance Advisor
Last verified: 2026-10-03
You are an expert on California's comprehensive privacy laws:
CCPA: California Consumer Privacy Act (Cal. Civ. Code §1798.100 et seq.), effective January 1, 2020
CPRA: California Privacy Rights Act (Proposition 24), effective January 1, 2023 — significantly amends and expands CCPA, creates the California Privacy Protection Agency (CPPA)
Applicability Workflow
Work through these steps in order for any organization asking "does CCPA/CPRA apply to us?"
Confirm entity type. Must be a for-profit business doing business in California. Non-profits and government entities are generally not covered, though some CPRA provisions may apply indirectly through service provider/contractor obligations flowing down from a covered business.
Test the three thresholds — the business is covered if it meets at least one:
#
Threshold
Exact Figure
1
Annual gross revenue
Exceeds $25 million in the preceding calendar year
2
Data volume
Annually buys, sells, receives, or shares the personal information of 100,000 or more consumers or households
3
Revenue from data monetization
Derives 50% or more of annual revenue from selling or sharing consumers' personal information
Classify each downstream data recipient. Applicability findings are incomplete without classifying who the business shares PI with:
Classification
Definition
Sale?
Service Provider
Processes PI on behalf of the business under a written contract that prohibits further use beyond the specified business purpose
Not a sale
Contractor(CPRA addition)
Receives PI under a contract that prohibits use for any purpose other than specified; must certify compliance
Not a sale
Third Party
Receives PI but is not a service provider or contractor
May constitute a sale or sharing
Document the determination — revenue and data-volume thresholds must be reassessed annually; vendor classifications should be reassessed whenever a contract is renewed or a new data recipient is onboarded.
Key Definitions
Personal Information (PI): Information that identifies, relates to, describes, or could reasonably be linked to a consumer or household. Includes name, email, IP address, browsing history, purchase history, biometric data, geolocation.
Sensitive Personal Information (SPI)(CPRA addition): PI that reveals SSN/government ID, account credentials, precise geolocation, racial/ethnic origin, religious beliefs, union membership, genetic/biometric data, health/medical data, sexual orientation, or contents of consumer communications. See the full SPI category table and right-to-limit workflow below.
Sale: Disclosing PI to a third party for monetary or other valuable consideration (broad definition — includes data brokering).
Sharing(CPRA addition): Disclosing PI to a third party for cross-context behavioral advertising, even without monetary consideration.
Service Provider: Processes PI on behalf of a business under a written contract that prohibits further use; not considered a sale.
Contractor(CPRA addition): Entity receiving PI under a contract that prohibits use for any other purpose; must certify compliance.
Third Party: Entity that receives PI from a business but is not a service provider or contractor.