CCPA compliance software should help a business find personal information, act on a California consumer’s request, apply a privacy choice across the relevant systems and show what happened. It does not decide whether the law applies to your business, interpret an exception or make an untested opt-out mechanism lawful. For a privacy lead choosing a tool, the buying test is a real request and a real data flow, not a compliance percentage.
The California Department of Justice explains the rights to know, delete, correct, opt out of sale or sharing, and limit certain uses of sensitive information. It also explains that the CPRA amended the CCPA rather than creating a separate law. The official overview and the California Privacy Protection Agency’s current regulations are linked in Keep reading. Use those sources with counsel to define your obligations before asking a vendor to automate them.
| Job to test | Show in the demo | Person still accountable |
|---|---|---|
| Consumer request | Intake, identity check, system search, decision, response and retained history | Privacy owner decides scope and exceptions |
| Opt-out | Preference signal reaches the site, tags and downstream recipients | Engineering verifies enforcement in production |
| Data inventory | Record category, purpose, system, owner and recipients | Data owners confirm that the map is complete |
| Service provider oversight | Current contract, data flow, assessment and follow-up decision | Legal and procurement approve the relationship |
A useful demonstration follows one piece of personal information through each workflow.
What CCPA compliance software must support
Separate the jobs hidden inside the label. A consent or preference manager works at the website edge. A rights-request tool receives and routes consumer requests. A data discovery tool maps information across databases and applications. A broader compliance platform holds policies, evidence, control owners and vendor decisions. Some products combine these jobs; many do not. Buying a broad platform to replace a broken opt-out link is a category mistake, as is buying a cookie banner to manage requests in a support database.
Write one acceptance criterion for each obligation that applies to you. For a request to know, can the team identify all relevant systems and create a reviewed response? For a deletion request, can it document a lawful exception and notify the systems or service providers that must act? For an opt-out, can it show that the choice actually changed processing? The California DOJ overview is the starting point for the rights, while the applicable statute and regulations determine the precise process. A vendor checklist cannot replace that reading.
Do not accept a feature name as a test result. Ask to see a request submitted, assigned, verified where appropriate, answered and exported with a decision trail. Ask who can see sensitive material, how access is logged and how a mistaken response can be corrected. If a vendor only shows a dashboard of completed tasks, you still do not know whether the underlying action reached the data.
Start with applicability and the data flow
Before comparing prices, establish whether the business is subject to the CCPA and which of its processing activities are in scope. Counsel should check the current statutory definition and thresholds using the California text, because revenue, consumer-data volume and the role of an entity matter. A US company outside California may still handle California residents’ information. A product sold internationally may also have other privacy duties. Software can record the analysis; it should not present a green badge as legal advice.
Draw the path of one customer record. Start at the collection point, then follow it through analytics, CRM, support, billing, backups and external processors. Name the owner of each system, the categories of information it receives, why the business uses it, who can access it and where it goes next. Include marketing pixels and development environments if they receive real data. The inventory must be specific enough that a consumer request can be fulfilled without guessing who owns a copy.
Use the product trial to prove the inventory rather than to build a polished map. Remove one known processor from the draft and see whether anybody notices. Compare the map with actual integrations, contracts and network traffic. If the platform cannot detect an omitted source, assign a manual reconciliation owner. A maintained spreadsheet can be better than an automatic map nobody verifies.
Test a consumer rights request from intake to response
Create a test request using a record you control. Check where the request enters, whether the correct team receives it, how identity is verified when verification is appropriate, and how the system avoids asking for more personal information than needed. Follow the request into each data store in your map. Record the decision for every system: disclose, correct, delete, retain under a documented exception or investigate further. Then review the outbound response and the retained audit history.
A good workflow makes uncertainty visible. If a source is offline, an owner is absent or a service provider has not confirmed an action, the request should remain open with a reason. A status of “done” that conceals an unconfirmed downstream copy creates false confidence. The California DOJ materials explain that deletion has exceptions; the business has to decide whether one applies to the particular record. Do not let software silently turn every deletion request into unconditional removal.
Run a second request with an error. A consumer may give an old email address, use an authorised agent or dispute the information you found. Watch how the product records a correction and who approves the final response. Ask for an export that another reviewer can understand without access to the vendor’s dashboard. This is the point at which a workflow becomes defensible evidence rather than a list of tasks.
Test opt-out and Global Privacy Control in production
The California DOJ describes a right to opt out of sale or sharing, including through Global Privacy Control. Your first test is practical: make a privacy choice on the live website and inspect whether the relevant scripts, tags and downstream data flows change. Test a recognised browser signal as well. Keep evidence of both the consumer-facing control and the technical result. A screenshot of the button alone is not proof that the choice was honoured.
Do not confuse consent with an opt-out. The legal treatment depends on the activity and the current California rules. Ask legal counsel to define which activities count as sale or sharing and which choices the business must offer. Ask engineering to trace each affected destination, including advertising and analytics vendors. A platform may store the preference and still leave a tag firing until the website integration is corrected.
Repeat the test after a deployment and after adding a new marketing vendor. Privacy controls fail at integration boundaries. Save a dated test record, the person who reviewed it and the fix for any failure. If the chosen platform has no way to show that history, keep it in a separate controlled record. This is one reason a CCPA programme needs both working product controls and accountable evidence.
Check service providers, contracts and evidence
A request may require action by a service provider that holds a copy of the data. A tool cannot infer every contract term or decide the provider’s role from a logo in a vendor list. Join the data inventory to a contract register: what information goes to each party, for what purpose, under which agreement, and who confirms a request or opt-out reached that party. The California statute and regulations are the source for the legal relationship; contract interpretation belongs with counsel.
Test the exception path. Mark a processor as overdue on its review, record the risk decision and keep the former assessment after a replacement. A current green vendor score can hide a lapse during an earlier period. Evidr’s vendor-risk product describes assessments and monitoring; its evidence collection product describes uploads, review and control mapping. Those capabilities can support the record, but they do not sign a contract, verify a processor’s implementation or make a disputed legal classification for you.
The practical output is a history a privacy owner can inspect: source document, version, owner, decision, exception and follow-up. Use the same standard for the privacy notice, data map, request workflow and opt-out test. If the software cannot export its records in an intelligible form, ask how you will answer an investigation or migrate to another tool.
Compare a point tool with a broader platform
Choose the narrowest tool that closes the gap you have. If the immediate problem is a website preference mechanism, evaluate a privacy platform with a working tag integration. If the team repeatedly receives requests across many systems, test a rights-request workflow and data discovery. If you already operate those controls but cannot prove who reviewed them, a compliance platform may be the better next purchase. The broader compliance automation guide explains the evidence test for that last case.
Run the same scripted trial with each shortlisted vendor. Use a synthetic consumer record, a real test environment, an opt-out signal, one service provider and an intentionally missing system. Measure whether the missing system is visible and whether the team can export the decision trail. Ask what has to be built by your engineers, what the vendor operates, what the product retains and what happens when an integration fails. Those answers are more comparable than claimed percentages of automation.
Cost should include internal work. A licence can be affordable while integration and manual review consume the privacy team. A more expensive platform can make sense when the same evidence is reused for several frameworks and customer requests. Ask for written terms for your actual volumes, integrations, users and retention needs. Do not assume that a pricing tier includes a CCPA workflow because a framework badge appears on the homepage.
Where Evidr fits and where it does not
Evidr’s CCPA framework page describes consumer-rights workflows, a data inventory, opt-out preference management and service-provider oversight. Its evidence collection and vendor-risk pages describe how teams can keep reviewed records and follow-up decisions together. For a B2B company also managing SOC 2 or other frameworks, that shared evidence can reduce repeated filing. Test the particular workflow you need in your environment before committing; the public feature description is a claim to verify, not proof that your site and processors are configured.
There is a case against Evidr. A business whose only gap is a broken consent banner or a website tag firing after an opt-out should repair that technical path first. A business with no accountable privacy owner should assign one before buying a dashboard. Evidr cannot decide applicability, approve an exception, ensure a third party complies or give legal advice. The right next step is to run the synthetic request and opt-out trial, inspect the evidence it produces, then compare the current plan on the pricing page with the work you would otherwise do manually.