Add missing _index.org files for 7 sections: stages, ai-agents-scoping, compliance, impact, social-protocol, verification, resources — rebuild clean after file reorganization

projects/passepartout/strategy/compliance/compliance-regimes/ccpa-cpra.org

@@ -0,0 +1,24 @@
+:PROPERTIES:
+:ID:       87996d87-100c-4bf6-8546-a860b9d7c25b
+:ID:       auto-ccpa-cpra
+:CREATED:  [2026-05-23 Sat]
+:END:
+#+title: CCPA/CPRA (California Consumer Privacy Act)
+#+filetags: :passepartout:compliance:framework:ccpa:
+
+
+California's comprehensive privacy law — the closest US analogue to [[id:513d5996-4ac7-4567-a992-18fc01599104][GDPR]].
+CPRA (effective 2023) amended and strengthened CCPA. Key rights: right to
+know, delete, opt out of sale/sharing, correct inaccurate data, limit use
+of sensitive PI. Private right of action for data breaches.
+
+Who must comply: For-profit businesses with >$25M revenue, or handling >100K
+consumer records, or deriving >50% revenue from selling PI. Extraterritorial —
+applies to any business collecting CA resident data.
+
+Penalties: $2,500 per violation (intentional: $7,500). Private right of action
+for breaches: $100-$750 per incident per consumer. CPRA created the California
+Privacy Protection Agency (CPPA) for enforcement.
+
+Why it matters: The opt-out/sale/sharing requirements create complex data flow
+gate rules. The gate stack can encode "this data flow crosses a CCPA boundary"