CPRA Passes: California Voters Approve Proposition 24

As the dust settles on the 2020 election, one result is clear: California voters have approved Proposition 24, and the California Privacy Rights Act of 2020 (CPRA) will become law. Pending official certification of the results, the initiative’s “yes” votes outnumber “no” votes by an approximately 56–44% margin. Covered businesses have just over two years to prepare for any compliance challenges that the CPRA’s passage may pose, as most of its provisions become operative on January 1, 2023.

The CPRA will significantly amend the California Consumer Privacy Act of 2018 (CCPA) and create the California Privacy Protection Agency to enforce the CCPA, making California the first state with its own privacy regulator. Among other amendments, the CPRA:

• Adds a new category of “sensitive personal information,” and giving consumers the right to opt out of certain uses and disclosures of their sensitive personal information;
• Gives consumers the right to have inaccurate personal information about them corrected;
• Requires covered businesses to include additional information in its privacy notices; and
• Imposes a purpose limitation on the collection, use, retention, and sharing of consumers’ personal information.

The CPRA also extends the CCPA’s partial exception for employees, independent contractors, business representatives, etc., through January 1, 2023. Notably in this respect, California A.B. 1281, a recently enacted CCPA amendment on which we reported last month, will not become operative because of the CPRA’s passage.

For a more detailed analysis of the ways in which the CPRA will amend the CCPA, please see our earlier client alert, and for additional CCPA and CPRA resources, please visit our CCPA Resource Center.