What’s the difference between CCPA, CPRA, VCDPA, CPA, and CTDPA, and how do I comply with all of them?

They’re state-level privacy laws, all GDPR-flavoured but with different scopes:

• CCPA (California, 2020), right to know, delete, opt-out of sale
• CPRA (California, 2023), adds “sensitive personal info” + Cal Privacy Protection Agency
• VCDPA (Virginia, 2023), opt-in for sensitive data, DPIA requirement
• CPA (Colorado, 2023), universal opt-out signal (Global Privacy Control)
• CTDPA (Connecticut, 2023), similar to CPA

Magento doesn’t handle this natively. We deploy a cookie-consent CMP (Cookiebot, OneTrust, or open-source Klaro), per-state-view opt-out flows, and a DSAR automation (data-subject-access requests handled in < 45 days). Configured per state-view, not site-wide, California users see the “Do Not Sell” link, others don’t.