While the 2020 election did not deliver an immediate consensus on every candidate and issue, one thing is clear: Californians want more control over personal information and have demanded that businesses take their privacy seriously. Less than a year after the United States’ first major comprehensive consumer privacy law – the California Consumer Privacy Act of 2018 (“CCPA”) – went into effect, and Californians voted in support of Proposition 24, which will eventually replace the CCPA with the new California Privacy Rights Act (“CPRA”).

The CPRA will build on the CCPA by introducing additional privacy protections for California residents and requiring the businesses subject to those laws to revisit once again and update their privacy programs. Although some provisions of the CPRA will be effective immediately after the CPRA becomes law, the majority of the law will not become operative until January 1, 2023. Still, it will apply to personal information collected on or after January 1, 2022.

Among the provisions taking immediate effect are an extension of the employee and business-to-business exceptions until January 1, 2023, giving businesses subject to the CCPA/CPRA more time as they work to come into compliance with these already delayed requirements. The CPRA also immediately creates the California Privacy Protection Agency. This new agency will be “vested with full administrative power, authority and jurisdiction to implement and enforce the CCPA, as amended by the CPRA” and is supported by three other measures that fund, transfer authority to the agency kick-off the next round of rulemaking.

The CPRA is intended to bring California’s consumer privacy law into closer alignment with the EU’s General Data Protection Regulation (“GDPR”) by giving California residents more concrete controls over their personal information. The law introduces the GDPR-like right to correct the personal information held about them and additional protections for the new category of “sensitive” personal information. It will require more specific disclosures from businesses about what personal information they collect and share.  It also codifies the definition of “consent,” increases protections for children’s personal information under the age of 16, targets geolocation data and cross-context behavioral marketing, and only permits legislators to make changes designed to strengthen privacy. The CPRA even modifies the now ubiquitous “Do Not Sell My Personal Information” website opt-outs to incorporate new rights for consumers to also opt-out to share their personal information and limit the use of their sensitive personal information.

For businesses, the CPRA amends the thresholds triggering the requirement to comply with the law, reducing the number of smaller businesses subject to its obligations. Under the CPRA, the $25 million revenue threshold will look back to the prior calendar year. The “volume” threshold has been revised so that it applies to a business that “annually buys or sells, or shares the personal information of 100,000 or more consumers or households,” up from 50,000 consumers and households while eliminating “devices” as a defined collection point. Finally, the “data broker” threshold has been amended, so the CPRA applies to businesses that derive 50% or more of their annual revenues from selling or, now, sharing consumers’ personal information. If your company does business in California and you have not yet evaluated whether you must comply with CCPA, it is not too late to start working toward compliance and preparing for the operational date of the CPRA.

Planning for the future of privacy requirements should be a serious consideration for all businesses. States across the country have implemented various privacy, data breach laws, and more under consideration in states such as Illinois, New York, and Washington. If you have questions about whether or how CPRA or other privacy laws apply to your business and what you need to do to comply, please reach out to us to discuss how to protect the privacy of your customers’ personal information.