General · Philterd

CCPA / CPRA Consumer Privacy Redaction

Redact personal information and sensitive personal information as defined by the California Consumer Privacy Act (CCPA/CPRA) from consumer records.

View policy → Download JSON → View source on GitHub

v1.0.0 Updated 2026-06-08 Philter >=3.0.0 By Philterd

CCPACPRACaliforniaconsumer privacypersonal informationsensitive personal informationprivacy

The policy

The full ccpa-consumer-privacy.json file. The same content you’d get by downloading. Copy any part of it, or use the buttons in the hero to grab the whole file.

{
  "config": {
    "splitting": {
      "enabled": false,
      "threshold": 4000
    }
  },
  "ignored": [],
  "identifiers": {
    "person": {
      "phEyeFilterStrategies": [
        {
          "strategy": "REDACT",
          "redactionFormat": "{{{REDACTED-%t}}}",
          "condition": "confidence > 70"
        }
      ]
    },
    "emailAddress": {
      "emailAddressFilterStrategies": [
        {
          "strategy": "REDACT",
          "redactionFormat": "{{{REDACTED-%t}}}"
        }
      ]
    },
    "phoneNumber": {
      "phoneNumberFilterStrategies": [
        {
          "strategy": "REDACT",
          "redactionFormat": "{{{REDACTED-%t}}}"
        }
      ]
    },
    "streetAddress": {
      "streetAddressFilterStrategies": [
        {
          "strategy": "REDACT",
          "redactionFormat": "{{{REDACTED-%t}}}"
        }
      ]
    },
    "ssn": {
      "ssnFilterStrategies": [
        {
          "strategy": "REDACT",
          "redactionFormat": "{{{REDACTED-%t}}}"
        }
      ]
    },
    "driversLicense": {
      "driversLicenseFilterStrategies": [
        {
          "strategy": "REDACT",
          "redactionFormat": "{{{REDACTED-%t}}}"
        }
      ]
    },
    "passportNumber": {
      "passportNumberFilterStrategies": [
        {
          "strategy": "REDACT",
          "redactionFormat": "{{{REDACTED-%t}}}"
        }
      ]
    },
    "date": {
      "onlyValidDates": true,
      "dateFilterStrategies": [
        {
          "strategy": "TRUNCATE_TO_YEAR",
          "condition": "context == \"birth\""
        }
      ]
    },
    "creditCard": {
      "onlyValidCreditCardNumbers": true,
      "creditCardFilterStrategies": [
        {
          "strategy": "MASK",
          "maskCharacter": "*",
          "maskLength": "SAME",
          "leaveCharacters": 4
        }
      ]
    },
    "ipAddress": {
      "ipAddressFilterStrategies": [
        {
          "strategy": "REDACT",
          "redactionFormat": "{{{REDACTED-%t}}}"
        }
      ]
    },
    "macAddress": {
      "macAddressFilterStrategies": [
        {
          "strategy": "REDACT",
          "redactionFormat": "{{{REDACTED-%t}}}"
        }
      ]
    },
    "url": {
      "urlFilterStrategies": [
        {
          "strategy": "REDACT",
          "redactionFormat": "{{{REDACTED-%t}}}"
        }
      ]
    },
    "identifiers": [
      {
        "classification": "state-id",
        "pattern": "\\b(?:state id|california id|CA id|identification card)[\\s:#]*[A-Z0-9-]{6,}\\b",
        "caseSensitive": false,
        "identifierFilterStrategies": [
          {
            "strategy": "REDACT",
            "redactionFormat": "{{{REDACTED-STATE-ID}}}"
          }
        ]
      },
      {
        "classification": "account-number",
        "pattern": "\\b(?:account|acct)[\\s:#]*(?:number|#)?[\\s:#]*\\d{6,}\\b",
        "caseSensitive": false,
        "identifierFilterStrategies": [
          {
            "strategy": "MASK",
            "maskCharacter": "*",
            "maskLength": "SAME",
            "leaveCharacters": 4
          }
        ]
      }
    ]
  }
}

Example

Input

Consumer Maria Garcia (SSN 555-12-3456) of 88 Pine St, San Jose used account 4455667788. Email maria.g@example.com, phone (408) 555-0142, IP 203.0.113.7. CA driver license D1234567.

Output

Consumer {{{REDACTED-person}}} (SSN {{{REDACTED-ssn}}}) of {{{REDACTED-streetAddress}}}, San Jose used account ****7788. Email {{{REDACTED-emailAddress}}}, phone {{{REDACTED-phoneNumber}}}, IP {{{REDACTED-ipAddress}}}. CA driver license {{{REDACTED-driversLicense}}}.

Entities this policy acts on

NAMEEMAILPHONEADDRESSSSNLICENSEPASSPORTDATECREDIT_CARDIPMACURLSTATE_IDACCOUNT

What this policy does

Removes personal information (PI) and sensitive personal information (SPI) as defined by the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA).

The CCPA defines personal information very broadly — information that identifies, relates to, or could reasonably be linked with a consumer or household (Cal. Civ. Code § 1798.140(v)). The CPRA added a sensitive personal information subcategory (§ 1798.140(ae)) covering SSNs, driver’s licence / state ID numbers, financial account access, precise geolocation, and similar.

This policy targets:

Names — redacted (confidence-gated)
Email, phone, postal address — redacted (identifiers under § 1798.140(v))
SSNs, driver’s licence, passport, state ID — redacted (sensitive personal information)
Birthdates — truncated to year only when context indicates a birth date
Credit card numbers and account numbers — masked to last 4 visible (financial-account SPI)
IP addresses, MAC addresses, URLs — redacted as unique / online identifiers

When to use this

Fulfilling a consumer “right to know” / access request where another consumer’s or household’s PI must be redacted from the disclosed records
Sharing consumer data with a service provider or contractor under a CCPA-compliant contract that limits use to business purposes
De-identifying data so it falls outside CCPA scope (§ 1798.140(m)) before analytics or model training
Data-broker and advertising pipelines where opt-out / “Do Not Sell or Share” signals require stripping identifiers
Internal analytics across teams where full consumer identity isn’t needed

When to customize

Household linkage. CCPA covers “household” data. If your records can be re-linked to a household through combinations of non-redacted fields (e.g. address + device), evaluate those combinations — field-level redaction alone may not de-identify.
Precise geolocation. CPRA treats precise geolocation as SPI. This policy does not detect lat/long or GPS coordinates by default; add a custom identifier if your data contains them.
State / consumer ID formats. The default state-id pattern is keyword-anchored. Replace it with the exact California DL/ID format if you only process California records.
Name confidence threshold. Default redacts names above confidence 70. Adjust for precision vs recall.
De-identification standard. To rely on the CCPA’s de-identified-data exemption you must also commit to not re-identifying and implement safeguards (§ 1798.140(m)); redaction is a necessary but not sufficient step.

Both are broad consumer/data-subject privacy regimes, and the entity coverage overlaps heavily. Key differences for redaction purposes:

	CCPA / CPRA	GDPR
Jurisdiction	California residents	EU/EEA data subjects
Unit of protection	Consumer and household	Natural person
Sensitive subcategory	“Sensitive personal information” (§ 1798.140(ae))	“Special categories” (Art. 9)
Companion policy here	(this policy)	gdpr-personal-data.json

If you operate in both regimes, the GDPR policy adds health/special-category detection; the two can be stacked on the same document.

Compliance notes

Cal. Civ. Code § 1798.100 et seq. — the CCPA, effective 1 January 2020
California Privacy Rights Act (CPRA) — amended the CCPA; most provisions effective 1 January 2023, enforced by the California Privacy Protection Agency (CPPA)
§ 1798.140(v) — definition of personal information
§ 1798.140(ae) — definition of sensitive personal information
§ 1798.140(m) — standard for de-identified data (outside CCPA scope)
This policy is a baseline starting point, not legal advice or a de-identification certification. Assess re-identification and household-linkage risk for your specific dataset.

References

Use this policy

Download and load into your running Philter instance:

# Download the policy
curl -O https://raw.githubusercontent.com/philterd/pii-redaction-policies/main/policies/philterd/general/ccpa-consumer-privacy.json

# Upload to your Philter instance
curl -X POST http://localhost:8080/api/policies \
     -H "Content-Type: application/json" \
     --data @ccpa-consumer-privacy.json

# Redact text using the policy
curl http://localhost:8080/api/filter?p=ccpa-consumer-privacy \
     --data "your text here" \
     -H "Content-Type: text/plain"

No Philter instance yet? Deploy one in 5 minutes → · Want to tune this policy against your data? Talk to the team.

← All policies