CPRA applies to data sharing, rather than selling, making it more broadly applicable to businesses. Businesses who bought, sold, or shared for commercial purposes the personal information of 50,000 or more consumers, households, or devices must comply with CPRA.