How to configure a notice for CPRA compliance?

Didomi now enables you to build consent notices compliant with California Privacy Rights Act (CPRA). CPRA has particular features that must be included in your notice: 

• Vendors  processing Sensitive Personal information (SPI)
• Purposes grouped into pre-defined categories
• Global Privacy Control (GPC) taken into consideration. 

The following steps show you how to properly configure CPRA on your notice. 

✅ Add SPIs to your vendors

Sensitive Personal Information (SPI) is defined as personal information that is not publicly available, and which reveals information related to:

• Precise geolocation,
• Racial or ethnic origin, religious or philosophical beliefs, or union membership,
• Content of mail, email and text messages,
• Genetic data,
• Biometric information for uniquely identifying a user ,
• Health data,
• Sex life or sexual orientation.

You can include Sensitive Personal Information (SPI) in the Purposes section of your Data Manager and assign it to a Vendor when editing their details. SPI can be managed within the notice like any other purpose, allowing you to use all purpose-related features.

✅ Configure your CPRA notice

Follow these steps:

1. Go to Consent notices and choose Edit Notice. 
2. In the Regulations tab of step 1. Regulations, select CPRA from the list of regulations (additional several regulations can be selected, since Didomi supports multiple regulations).
3. Click on Edit Vendors & Purposes.
4. Select the vendors to be added to your CPRA notice. To create custom vendors, click on Add a new vendor. 
5. Scroll down to the Purposes section. The purposes associated with the selected vendors appear below the three default CPRA categories. You can choose to keep these default categories, edit or delete them.
6. Click on Add category to create your custom category.
7. Define the name of your category, the button labels for the Agree and Disagree action on your category.
   
8. Drag and drop your purposes into your categories.
9. Save.
10. You can now proceed to configure further notice parameters in step 2. Customization, before publishing in step 3. Publish.
    
    
    • Don't forget to fill in specific CPRA parameters for each step (Look & feel, Content editor, and Integrations, especially). 
    • You can see live previews of your CPRA notice, including all CPRA-specific parameters. 

Examples

• 1st layer  - When when SPIs are not defined

• Partners layer

✅ GPC signal

Global Privacy Control (GCP) is a privacy signal supported by several browsers for users to specify at the browser level that they do not want their data to be processed (more details about GPC and supported browsers available in GPC specifications). 

Didomi CPRA notices support GPC automatically. 

As soon as the signal is detected, your CPRA notice is adjusted to respect the user choice via GPC:

• A "GPC signal detected" icon is displayed in the notice. 
• All personal information will be set to Do not sell / Do not share.
• Instead of Agree and Close there will be a Close button.