No, the California Privacy Rights Act (CPRA) doesn't substitute the CCPA; instead, it amends it. The CPRA is an extension of the CCPA, altering existing provisions while introducing extra obligations for businesses in California. The CPRA became effective on January 1, 2023.

Under the CCPA, businesses must reveal their methods of collecting, using, and holding personal information of California residents. This necessitates having a dedicated privacy policy specific to the CCPA, accessible to consumers.
A CCPA privacy policy should encompass the particulars of collected personal information, its usage, and sharing practices. Additionally, it should outline consumers' rights according to the CCPA and the procedures for exercising these rights.

The California Privacy Rights Act (CPRA) pertains to any profit-seeking organization or business operating in California or gathering personal information from its residents. The CPRA can be relevant to an entity that:
  - Conducts business activities in California
  - Acquires personal data of California residents
  - Fulfills specified revenue or data processing criteria.
Should a business satisfy any of these conditions, it will be bound by the CPRA's regulations, irrespective of its physical presence in California.

The Virginia CDPA shares several similarities with the California Consumer Privacy Act (CCPA). However, they diverge in scope and enforcement in key ways. Notable distinctions include:
   - CCPA considers revenue as a threshold, whereas CDPA applies when a business controls or processes personal data of at least 100,000 consumers.
  - Unlike the CCPA, CDPA lacks a provision for private legal action in cases of non-compliance.
  - The CCPA allows users to opt out of their personal data being sold, while the CDPA expands this to encompass targeted advertising and user profiling.

The Colorado Privacy Act classifies sensitive data as a separate category of personal information. This category includes data that could reveal various traits of a consumer, such as race, sexual orientation, religious belief, citizenship or citizenship status, genetic or biometric data, as well as personal data from a child under the age of 13.

The Connecticut Data Privacy Act (CTDPA) provides exemptions for six types of organizations, which are:
  - Local and state governments
  - Non-profit entities
  - Higher education institutions
  - National security associations registered under the Securities Exchange Act of 1934
  - Financial institutions subject to the Gramm-Leach-Bliley Act
  - Entities covered under HIPAA

Additionally, there are sixteen categories of data-level exemptions. These encompass information regulated by laws such as HIPAA, FERPA, the Driver’s Privacy Protection Act, the Family Educational Rights and Privacy Act, the Farm Credit Act, and the Airline Deregulation Act, along with employee and job applicant data.