On November 3, voters in California approved Proposition 24 to pass the California Privacy Rights Act (CPRA). The final result was closer than pre-election polls suggested, but 56% of voters approved the measure, nonetheless.
CPRA builds on the California Consumer Privacy Act (CCPA). When it takes effect in January 2023, CPRA will enshrine a tougher set of data privacy rules for businesses, give consumers more rights on how their data can be used, and establish a separate agency for rule-making and enforcement called the California Privacy Protection Agency (CPPA). More precisely, CPRA would:
- Create a broad category of “sensitive” personal data—a designation that includes a person’s race or ethnicity, their genetic data, their sexual orientation, and data about their health, among other information—which consumers can limit to approved uses
- Require businesses to create a link on their homepages where consumers can opt out of having their data sold, shared, or used
- Give consumers the right to correct information businesses have on them
- Strengthen opt-in requirements for data on children, and increase penalties for the forbidden use or sharing of such data
- Set limits on how long businesses can keep data
- Provide an opt-out for “cross-context behavioral advertising,” defined in CPRA as targeted advertising based on users’ personal information that was collected across a variety of digital touchpoints, such as websites, apps, and services
For marketers already struggling to meet compliance deadlines for CCPA, CPRA represents another legal hurdle, and one that will be lot more onerous than what they currently face, at least for large marketers who have data on more than 100,000 households (as opposed to the 50,000 threshold under CCPA). If the act goes into effect in 2023, most personalized advertising will no longer be possible in California, and many parts of the data ecosystem will struggle to adapt.
The long lead time until the law takes effect, however, gives businesses time to adapt. It also puts additional pressure on the federal government to come up with a national data privacy law that may supersede it. “I think that CPRA’s most impactful provision is when it takes effect: January 2023,” said Caitlin Fennessy, research director at the International Association of Privacy Professionals (IAPP), prior to its passage. “CPRA would create the impetus and provide the time frame for adoption of federal privacy legislation. And I think that was intentional on the part of the ballot initiatives’ proponents.”
