Engineers heading into a first California customer often imagine CCPA as a giant privacy audit of the repository. It is mostly not that. The California Consumer Privacy Act, as amended by the CPRA, is one statute, not two frameworks. The bulk of a program is notice at collection, request handling, vendor contracts, and whether the law applies at all. Only a slice is decided by what your code does.
This page is that code-facing slice. It is not an applicability determination, legal advice, or a promise that installing heyGRC reviews CCPA on the next pull request. CCPA review runs when CCPA is selected in organization configuration. A bare install reviews ISO 27001, SOC 2, and GDPR until someone saves a selection.
The duties that touch code
Three duties routinely show up in a diff. Section 1798.100(a)(3) is retention: a disclosed period or criterion per category, and no retention longer than reasonably necessary for that purpose. Section 1798.105(c)(1) is deletion after a verifiable request, subject to the exceptions in subsection (d). Sections 1798.120 and 1798.135 are the right to opt out of sale or sharing and the methods. 11 CCR § 7025 requires processing a qualifying preference signal even when the homepage link exists; omitting the link is only for the frictionless-signal path. The parent page maps these to diffs.
Notice at collection, consumer request portals, and vendor contract language are real CCPA work. They usually do not live in an application pull request. Treat them as out of this page.
The changes that become findings
A new identified events table with no purge job is a retention question. A search index that the delete-my-data path does not clear is a deletion question. A conversion pixel that drops the Sec-GPC guard is a sale-or-share question, if that destination is a sale or a share at all. A third-party SDK is not automatically either one.
Flagged in the pull request, the author still has the context to wire the bound, the delete path, or the signal. Found after a regulator or a consumer request, it is a reconstruction.
Where heygrc fits, and the honesty boundary
heygrc is built to recognize those shapes when CCPA is one of the frameworks you selected, and to cite the section so the question is visible in the pull request. Findings are illustrative. They ask you to compare the change with the privacy design you already wrote down. They do not determine applicability, classify a transfer as a sale, or decide a deletion exception. A starter .heygrc.md file is context only. It does not enable the pack.
Whether the law applies is a different question. Use the ISMS Copilot checker linked below. The parent page is the duty-to-diff map; this page is the mental model of what belongs in a repo review.