Prop 24: New Privacy Regulations Rock The State of California

A Special Report from Compliance & Privacy Partners

California Privacy Rights Act
The CPRA amends and expands the California Consumer Privacy Act (CCPA)—California’s current privacy law that itself is nearly brand new.

Californians took a step toward more privacy protections when they voted to pass Proposition 24 on November 3. The ballot created what’s known as the California Privacy Rights Act, known as the CPRA, which will expand and amend the previously-existing California Consumer Privacy Act (CCPA). So, what does this mean for Californians and companies that do business in the state? It can be confusing, so let’s take a closer look at some of the law’s major points.

The Background

California has a unique system of ballot propositions. It allows people and groups to go around the state government to get certain initiatives passed into law.

To appear on an official ballot, groups must file a proposal with the attorney general’s office. Then, they must receive a certain number of signatures supporting the measure by a specific date. Once those signatures are confirmed, the proposition can appear on the ballot.

In 2020 alone, there were 12 ballot measures on which Californians could vote. If a ballot measure passes, it becomes law in the state — regardless of how elected officials feel about it.

The group that supported the CPRA, Californians for Consumer Privacy, has also supported other privacy measures in the past. In 2018, they got enough signatures to get the CRPA on the ballot, but they agreed to withdraw that application in exchange for the state legislature passing the CCPA.

In the two years since its passage, the group wasn’t satisfied with how the CCPA turned out. So, it moved forward again with a ballot for the CPRA, which the group saw as a stronger law.

What Does CPRA Do?

This new law is now the baseline for all privacy laws within California. Only a further ballot measure would be able to repeal it. If lawmakers were to pass an amendment to it, the groups that support CPRA could sue to have that blocked.

The only other way that the law could be changed or modified is through a future ballot passage, or if the federal government or court system invalidated it. That could be done only if it were ruled unconstitutional, or if a federal privacy law pre-empted it.

Is CPRA Effective?

There is an adjustment period now that CPRA has passed. Most of the significant provisions won’t take effect for two more years — on January 1 of 2023. This gives businesses that are affected enough time to make necessary changes. The “Right to Know” provision of the law takes effect a year earlier, on the first of 2022.

In the meantime, businesses have to comply with the current CCPA until the CPRA is fully in effect.

What Are the Differences Between CPRA and CCPA?

There are several ways that the new law differs from the original one. It seeks to take consumer privacy one step further in many cases.

There are ten primary areas where the two are different.

1. Business Regulations

A “covered business” is redefined under CPRA. In some instances, the number of businesses covered will decrease from CCPA, while in others, it will increase. That’s because:

  • It will not be applied to as many small and mid-sized businesses as CCPA because the threshold for the number of households/consumers has been increased from 50,000 to 100,000.
  • Businesses that buy, sell, or share personal information are subject to the new CPRA. Companies that get at least half of their yearly revenue in this way are subject to the law.

2. Sensitive Personal Information

The law creates an entirely new dataset known as “sensitive personal information.” It’s now subject to full disclosure and limitation. Consumers also now have the right to limit the use of their personal information by businesses.

CCPA is much broader in how it treats sensitive personal information, but not so for CPRA. There are separate restrictions and requirements on this type of information, including:

  • A requirement to offer an opt-out for both disclosure and use of it
  • A required opt-in consent standard for disclosure and use of it
  • A requirement that limits the purpose of use
  • A requirement on full disclosure

See the differences between various privacy laws below.

3. New and Expanded Rights

CPRA not only modifies some of the privacy rights California consumers have under CCPA; it also creates brand new ones.

Some of the modified rights include:

  • Businesses have to notify third parties that they must delete personal information they buy or receive.
  • Data applicable under “Right to Know” is now expanded beyond just the previous 12 months if collected after January 1 of 2022.
  • Opt-outs must also include the sharing of personal information, not just the sale of it to third parties.
  • Businesses have to abide by the same opt-in selling rights to minors. In other words, they now must wait at least 12 months after a minor has declined to sell/share their personal information.
  • Consumers can request their personal information be transmitted in a specific way — as long as it is commonly used and structured.

Some of the new rights include:

  • Consumers can request corrections if any of their personal information is wrong.
  • Consumers can opt-out of technology that makes decision-making regarding personal information automated. In other words, they can’t be profiled based on a consumer’s health, interests, location, economic situation, etc.
  • Consumers can also request information about any automated decision-making technology.
  • Consumers can limit the use of their sensitive personal information. They can ban businesses from sending it to third parties altogether.
  • Cybersecurity audits and risk assessments are now mandatory for any activity that is labeled high-risk. These audits have to be submitted regularly to the California Privacy Protection Agency.

4. Behavioral Advertising

CPRA seeks to regulate all digital advertising. It will now separate digital advertising into two categories — non-personalized and cross-context behavioral.

Personal information that businesses want to share for cross-context behavior must be subject to the Right to Opt-Out, while the other is not. This first-party advertising, as it’s called, is designated for internal business use.

There were already many businesses who were treating the Right to Opt-Out under CCPA this way. So, they won’t be required to make many changes, if any at all, in this regard.

5. New Authority

CPRA will establish a new agency that will be tasked with enforcing the law. It will be called the California Privacy Protection Agency, or CPPA. The new body will have the power to make rules, enforce rules, and investigate instances of non-compliance.

Also, there will no longer be a 30-day “cure period,” as there is under the current CCPA. This means that once a business is notified of a potential violation by the state attorney general’s office, they must act right away.

This new law will also increase maximum penalties up to $7,500 for any violation that concerns a minor. That’s triple the current maximum under the CCPA.

6. GDPR Alignment

Some of the CPRA is structured after the General Data Protection Regulation (GDPR) law that has been in effect in Europe since 2018. The three main areas that are now codified are:

  • Data: Businesses have to limit the collection, retention, sharing, and use of personal information only to what is considered “reasonably necessary and proportionate” to their purpose. It also can’t be processed for undisclosed and/or incompatible uses.
  • Storage: Businesses always have to tell consumers how long they’re retaining their personal information, and they must do this for every category of personal information. They also can’t hold onto the information for longer than “reasonably necessary” for each purpose they disclose.
  • Purpose: If a business wants to change a purpose for why they collect and/or use personal information, they must issue a new consumer notice.

Businesses that don’t comply are now also subject to enforcement through the newly-created CPPA. A violation of any three of these codes is enough for enforcement, even if no other offense is committed.

7. Service Providers

CPRA creates a new category of businesses called “contractors,” which amends the definition of a “service provider.” Contractors must now not only abide by these regulations, but they must state that they understand them and will abide by them.

They must notify businesses if they work with any sub-contractor sub-service provider, and those parties must abide by the same rules in a similar written contract.

These contractors and service providers must help businesses if a consumer makes a request for privacy. Finally, companies have to hold service providers/contractors accountable (via contract) from combining the personal information they receive with other collected data.

8. Exemptions

The CPRA did grant some leeway to the state Legislature to work on regulations about business-to-business and employee exemptions. They now have until the start of 2023 to do so through a new bill. The Legislature could, of course, try to challenge this aspect of the CPRA, but they’d be in for a fight if they indeed tried to do so.

9. Consent Standard

A consent standard existed under CCPA, but it will now more closely align with the definition laid out under GDPR. This makes it much stricter, although some of this already existed under CCPA.

It includes:

  • Research exemptions
  • Financial incentive programs and an opt-in consent
  • Consent to disclosure and use by a secondary firm after already opting out
  • Minors having the power to opt-in to their personal information being shared or sold
  • Consent required to sell or share personal information following an opt-out

10. Data Breaches

The CCPA already has a private right of action in place for data breaches, and CPRA doesn’t alter that in any way.

What’s Next?

CPRA becomes fully effective on the first day of 2021. Starting around the mid-point of next year, the process of officially making the rules will begin. The Legislature has until July 1 of 2022, to adopt the final regulations under CPRA. One year after that, the CPPA will have full authority to enforce the new law.

CPRA is set to alter and expand California consumers’ privacy rights over the next few years. But there’s still a ways to go before everything is entirely in effect.

Turn Waves Of Regulation Into Oceans Of Opportunity with CAPP.

New regulations governing the use of consumer’s personally identifiable information (PII) needn’t be burdensome.  In fact, they can help protect your organization, reduce operating expenses, and identify opportunities for better governance that ensure you avoid fines, litigation exposure, and foster trust that enhances customer experiences. To learn more about how Compliance & Privacy Partners can help prepare you for the new wave of privacy regulations reach out to us at 323-413-7432 or email us at for a free consultation with a Certified Information Privacy Manager.


Pursuant to the requirements of Government Code section 11346.8, subdivision (c), and section 44 of Title 1 of the California Code of Regulations, the California Department of Justice (Department) is providing notice of a third set of proposed modifications made to the regulations regarding the California Consumer Privacy Act.    

The Department first published and noticed the proposed regulations for public comment on October 11, 2019.  On February 10, 2020 and March 11, 2020, the Department gave notice of modifications to the proposed regulations, based on comments received during the relevant comment periods.  The Department withdrew the following sections from the review of the Office Administrative Law (OAL) pursuant to Government Code section 11349.3, subd. (c):  999.305(a)(5), 999.306(b)(2), 999.315(c), and 999.326(c).  OAL approved the other sections submitted by the Department, effective August 14, 2020, and these provisions became final.

The modifications are indicated by bold blue underline for proposed additions and red strike out for proposed deletions to the regulations that became effective on August 14, 2020.  This third set of modifications include the following changes:

  • Proposed section 999.306, subd. (b)(3), provides examples of how businesses that collect personal information in the course of interacting with consumers offline can provide the notice of right to opt-out of the sale of personal information through an offline method.
  • Proposed section 999.315, subd. (h), provides guidance on how a business’s methods for submitting requests to opt-out should be easy and require minimal steps.  It provides illustrative examples of methods designed with the purpose or substantial effect of subverting or impairing a consumer’s choice to opt-out.
  • Proposed section 999.326, subd. (a), clarifies the proof that a business may require an authorized agent to provide, as well as what the business may require a consumer to do to verify their request.
  • Proposed section 999.332, subd. (a), clarifies that businesses subject to either section 999.330, section 999.331, or both of these sections are required to include a description of the processes set forth in those sections in their privacy policies.

This Notice, the text of the third set of proposed modifications to the regulations, and a comparison of the text as approved by the Office of Administrative Law with the currently proposed modifications are available at  The originally proposed regulations and all documents relating to the rulemaking package, including previous modifications to the proposed regulations, are also available at this website.

The Department will accept written comments regarding the proposed changes between Tuesday, October 13, 2020 and Wednesday, October 28, 2020. Please limit comments to the additions indicated in bold blue underline and the deletions indicated in red strike out.  All written comments on the underlined changes must be submitted to the Department no later than 5:00 p.m. on October 28, 2020 by email to, or by mail to the address listed below.