The California Privacy Rights and Enforcement Act of 2020 (the “CPRA”) expands the privacy rights and protections provided to California consumers pursuant to existing state law, including the California Consumer Privacy Act of 2018 (the “CCPA”). Businesses that are subject to the CPRA must comply with various notice obligations and requirements related to the collection, deletion, sale and sharing of personal information.
This client alert provides a summary of some of the CPRA’s changes to the CCPA, the creation of the California Privacy Protection Agency and the effective date of the CPRA. This is simply a summary of some key points so check with your ECJ attorney for the critical details regarding the CPRA.
Changes to the CCPA
The CPRA expands and amends the CCPA in several respects. A few of the key changes are summarized below.
- Covered Business:
- If a for-profit business doing business in California collects, transfers or sells personal information and had annual revenue in excess of $25 million in the preceding calendar year, it is still a covered business. The CPRA clarified that the $25 million annual revenue must be from the “preceding calendar year.”
- Under the CCPA, a business that annually buys, sells or shares personal information for commercial purposes from 50,000 consumers, households or devices is a covered business. However, the CPRA increases the number of consumers and households from 50,000 to 100,000, and eliminates “devices” altogether from this prong of the definition. Therefore, under the CPRA, if a business annually buys, sells or shares the personal information of 100,000 or more consumers or households, it is a covered entity.
- In addition, the CCPA threshold that subjected a business that derives 50% or more of its annual revenues from selling consumers’ personal information was expanded to include either the selling or sharing of such personal information. Under the CPRA, “sharing” means sharing, renting, releasing, disclosing, disseminating, making available, transferring or otherwise communicating a consumer’s personal information to a third party for cross-context behavioral advertising, whether for monetary or other valuable consideration, including transactions between a business and a third party for cross-context behavioral advertising for the benefit of a business in which no money is exchanged.
- Sharing of Personal Information: The CPRA allows consumers to opt-out of the “sharing” of personal information, not just the “sale” of such information. Therefore, consumers have the right to opt-out of both the selling and sharing of their personal information to third parties for cross-context behavioral advertising. To that end, the “do not sell” button on a covered business’ homepage will likely evolve to a “do not sell and do not share” button.
- Sensitive Personal Information: A new category of personal information defined as “sensitive personal information” has been created and consumers may direct a covered business to use their sensitive personal information only as necessary to provide certain goods or services. “Sensitive personal information” includes a consumer’s social security number, financial information, precise geolocation, racial or ethnic origin, and sexual orientation.
- Minors: A covered business must obtain permission before collecting data from consumers under the age of 16 (i.e. an “opt-in” requirement from consumers under the age of 16) and must obtain permission from a parent or guardian before collecting data from consumers under the age of 13 (i.e. an “opt-in” from parents of consumers under the age of 13). The CCPA’s provisions regarding minors related only to the sale of a minor’s personal information, not the mere act of collection from such minors.
- Additional Disclosures: Under the CPRA, a covered business must also make additional disclosures in its privacy documents, including the length of time they will retain personal information, whether personal information is shared and the purposes for which sensitive personal information is collected or used.
California Privacy Protection Agency
The CPRA creates a new state agency, the California Privacy Protection Agency (the “Agency”), which will be responsible for enforcing California data privacy laws. The Agency will be governed by a five-member board and is charged with adopting regulations to implement the CPRA.
Effectiveness and Enforcement
Most of the CPRA’s provisions will not become effective until January 1, 2023, with enforcement beginning on July 1, 2023. This provides businesses with just over two years to review and update their privacy policies and practices to comply with this robust new law.
- Partner
Jeffrey R. Glassman is Partner and Chair of the Intellectual Property and Technology Law Department and has earned the esteemed designation of Certified Information Privacy Professional (CIPP/US).
Jeffrey has spent the last two ...
Subscribe
Recent Posts
- New Cal/OSHA Indoor Heat Standards Require New Prevention Measures and Written Prevention Plan | By: Joanne Warriner
- California Bans All Plastic Bags at Grocery Stores | By: Pooja S. Nair
- FTC’s Nationwide Ban on Non-Compete Agreements Stopped by Federal Court Ruling | By: Cate A. Veeneman
- Can the IRS Obtain a Receiver to Help Collect Taxes Owed? | By: Peter Davidson
- Severing Unconscionable Terms in Employment Arbitration Agreements | By: Jared W. Slater
- Can You Collaterally Attack a Receiver’s Appointment?
- Changes to PAGA Create Opportunities for Employers to Minimize Penalties | By: Tanner Hosfield
- Overbroad Employment Arbitration Agreements Will Not Be Enforced in California | By: Jared W. Slater
- LA Al Fresco Deadline Extended | By: Pooja S. Nair
- The Battle for Supremacy: Federal Arbitration Act v. California Arbitration Act | By: Jared W. Slater
Blogs
Contributors
Archives
- October 2024
- September 2024
- August 2024
- July 2024
- June 2024
- May 2024
- April 2024
- March 2024
- February 2024
- January 2024
- December 2023
- November 2023
- October 2023
- September 2023
- August 2023
- July 2023
- June 2023
- May 2023
- April 2023
- March 2023
- February 2023
- January 2023
- December 2022
- November 2022
- October 2022
- September 2022
- August 2022
- July 2022
- June 2022
- May 2022
- April 2022
- March 2022
- February 2022
- January 2022
- December 2021
- November 2021
- October 2021
- September 2021
- August 2021
- July 2021
- June 2021
- May 2021
- April 2021
- March 2021
- February 2021
- January 2021
- December 2020
- November 2020
- October 2020
- September 2020
- August 2020
- July 2020
- June 2020
- May 2020
- April 2020
- March 2020
- February 2020
- January 2020
- December 2019
- November 2019
- October 2019
- September 2019
- August 2019
- July 2019
- June 2019
- May 2019
- March 2019
- February 2019
- January 2019
- November 2018
- October 2018
- September 2018
- August 2018
- July 2018
- June 2018
- May 2018
- April 2018
- February 2018
- January 2018
- December 2017
- November 2017
- October 2017
- September 2017
- August 2017
- July 2017
- June 2017
- May 2017
- April 2017
- March 2017
- February 2017
- January 2017
- December 2016
- November 2016
- October 2016
- September 2016
- August 2016
- July 2016
- June 2016
- May 2016
- April 2016
- January 2016
- December 2015
- November 2015
- October 2015
- September 2015
- August 2015
- July 2015
- June 2015
- May 2015
- April 2015
- March 2015
- February 2015
- January 2015
- December 2014
- November 2014
- October 2014
- September 2014
- August 2014
- July 2014
- June 2014
- May 2014
- April 2014
- March 2014
- February 2014
- January 2014