CCPA / CPRA

Shufti is a compliant service provider under California law

Under CCPA/CPRA, your verification provider is either a service provider operating under strict contractual restrictions, or a third party with rights to use your users' data broadly. Shufti is a service provider and uses identity verification data solely to provide the verification service, not for any secondary purpose, and never sold or shared. Shufti service provider agreement is included in every enterprise contract.

Book a Demo Contact Us

Certification Overview

What CCPA / CPRA Covers

CCPA (2018)

The California Consumer Privacy Act established consumer rights over personal information: the right to know what data is collected, the right to delete it, the right to opt out of its sale, and the right to non-discrimination. It created the service provider classification, a vendor who uses data only for the contracted service.

CPRA (2023 Amendment)

The California Privacy Rights Act significantly expanded CCPA. It created a new category, sensitive personal information, which explicitly covers biometric data, facial images, and identity documents. It added the right to limit use of sensitive personal information, strengthened enforcement by establishing the California Privacy Protection Agency, and tightened service provider obligations.

Why It Matters

If your verification provider lacks a CCPA-compliant service provider agreement, or cannot technically support a consumer deletion or access request, you cannot meet your CPRA obligations when a California resident submits a request. The California Privacy Protection Agency is actively enforcing CPRA against businesses whose vendors fail to deliver the required protections.

You have 45 days to respond to a verified consumer rights request

Shufti's API and admin console let you locate, export, or delete an individual's verification records and generate a deletion confirmation. That confirmation is your regulatory evidence that the request was fulfilled.

45 days Statutory response window

For CCPA consumer rights requests. If your verification vendor cannot support individual record deletion or export within that window, the compliance gap is yours to carry.

Certification Assurance

Independently Verified Compliance Standards

Standard

CCPA/CPRA coverage for biometric and identity document data classified as sensitive personal information.

Assessed By

Service-provider role defined contractually, not as a third party or data broker.

Scope

Deletion, access, and portability supported via API and admin console within the 45-day response window, with coverage.

Documentation

CCPA/CPRA service-provider provisions included in the standard enterprise contract, with no separate addendum required.

How Shufti Maintains It

Shufti CCPA/CPRA service provider provisions are in the standard enterprise agreement, you do not need to negotiate a separate addendum. The contract restricts our data use, prohibits data selling and sharing, commits us to specific security standards, and requires us to cooperate on consumer rights requests.

The same compliance approach extends to Virginia CDPA, Colorado CPA, Connecticut CTDPA, and Texas TDPSA, so one Shufti integration covers you across those frameworks without separate addenda.