On November 3, 2020, Californians voted to pass Proposition 24, expanding and modifying the California Consumer Privacy Act (“CCPA”), which came into force on January 1, 2020. The new California Privacy Rights Act (“CPRA”) supersedes the CCPA and will be fully operative on January 1, 2023 (with a look-back period starting January 1, 2022). Until that time, the CCPA as written and amended generally remains in effect.  As we learned during the lead up to the CCPA, the time period to prepare for this type of comprehensive and complex legislation passes quickly, and businesses should begin their CPRA preparations sooner rather than later.  In this installment of the CPRA Digest, we discuss the expanded and new consumer rights under the CPRA, and the implications for organizations anticipating the CPRA.

Expanded Consumer Rights

The CPRA expands the following existing consumer rights:

  • In addition to having the right to request the categories of personal information about a consumer that a business sells, a consumer now also has to the right to know when their personal information is “shared” with a third party, and when information is otherwise disclosed for  a business purposes, including disclosures to a service provider.1

Under the CPRA, the concept of “sharing” personal information is novel and significant because it is aimed directly at cookies and similar technologies used for online advertising. “Sharing” is defined as renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal Information