CCPA, reviewed in the pull request.
The California Consumer Privacy Act, as amended by the CPRA, is one statute, not two frameworks. Most of it is notice, rights handling, and contracts. A smaller slice is decided in code: how long a store keeps personal information, whether a deletion request can reach every copy, and whether a sale or share still honors an opt-out. Those are the changes a pull request can quietly undo.
These pages assume you already turned CCPA on.
CCPA review is available when CCPA is explicitly selected in your heyGRC organization configuration. A bare GitHub App install has no framework picker. Unconfigured installations review against ISO 27001, SOC 2, and GDPR until someone saves a selection. A starter .heygrc.md file is repository context only. It does not enable the pack.
These pages assume your organization has independently determined that the law applies. heyGRC does not determine CCPA applicability and does not provide legal advice.
The CCPA duties a review can flag in a change.
Each row is a real Civil Code reference and the kind of change that appears to touch it. A useful finding names the section and asks you to compare the diff with the privacy design you already wrote down. It does not declare that the law applies, or that a transfer is legally a sale.
- § 1798.100(a)(3)retention per category
A new store of personal information ships with no visible retention bound, a purge job is removed, or a TTL is dropped, so the store no longer matches a disclosed period or criterion.
- § 1798.105(c)(1)deletion after a verifiable request
A new copy of personal information is added that the deletion path does not reach, or a hard delete is turned into an indefinite soft delete.
- §§ 1798.120 / 1798.135opt-out of sale or sharing
A new advertising or analytics destination starts receiving identifiers, or an opt-out preference signal (GPC) is no longer read before data leaves the system.
Per-duty deep dives:
A new events table with no end of life.
A pull request adds a table of identified product events. The feature works. Nothing sets a retention bound, and the existing purge job is not taught about the new table.
+ CREATE TABLE product_events (+ user_id uuid NOT NULL,+ payload jsonb NOT NULL,+ created_at timestamptz NOT NULL DEFAULT now()+ );This store holds identified event payloads with no visible retention bound. § 1798.100(a)(3) expects a disclosed period or criterion per category, and retention no longer than reasonably necessary for that purpose. Compare this table with the period you disclosed. A missing TTL is not, by itself, a determination that the law was violated.
A review, not a CCPA program.
heygrc flags changes that appear to touch a selected CCPA duty and cites the section so the question is visible in the pull request. It does not determine whether CCPA applies, whether a transfer is a sale or a share, whether a deletion exception applies, or whether you are a “business” under the statute. It is not legal advice and it does not make you CCPA compliant. Select CCPA in the console or API if this is a framework you review against.
Guide: What CCPA actually checks in your repo. Applicability is a different question. ISMS Copilot has a free checker.