Additional Consumer Privacy Protections Codified in the California Consumer Privacy Act go live!

On January 1, 2023, new privacy rights for California consumers went into effect under the California Privacy Rights Act (CPRA).  Businesses have several responsibilities associated with compliance with this statute, including responding to a consumer request to exercise these rights and giving consumers certain privacy notices. The final text for the CPRA is available here.  In March 2023, the California Privacy Protection Agency issued regulations amplifying information about the CPRA.

Consumers Gained Protected Privacy Rights in 2018

The California Consumer Privacy Act of 2018 (“CCPA”) provided consumers with more control over the personal information that businesses collect about them and provided consumers with certain rights, including:

• Knowing about the personal information a business collects on them and how that business uses and shares the information.
• Deleting personal information collected about them, subject to certain exceptions.
• Opting out of a business selling or sharing their personal information.
• Non-discrimination in exercising these rights.

Additional Privacy Rights added in 2020

In November 2020, California passed the CPRA, which amended the CCPA, adding the following additional privacy rights for consumers that began on January 1, 2023:

• The right to correct inaccurate personal information that a business has about them.
• The right to limit the use and disclosure of sensitive personal information collected about them.

What Information Is Protected under the CPRA?

The CPRA defines protected information as personal information or sensitive personal information:

• Personal Information is “information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly” with a particular consumer or household. This includes but is not limited to:
  • Name;
  • Social Security number;
  • Email address;
  • Internet browsing and search history;
  • IP address;
  • Geolocation data; and
  • Professional or employment-related information.
• Sensitive Information is a subset of personal information that includes but is not limited to information that reveals:
  • Government identifiers, such as a Social Security number;
  • An account log-in, financial account, debit card, or credit card number coupled with any required security code, password, or credentials that enables access to an account;
  • Contents of mail, email, and text messages;
  • Genetic or biometric data;
  • A consumer’s precise geolocation; and
  • A consumer’s racial or ethnic origin, religious or philosophical beliefs, or union membership.

The CPRA excludes publicly available personal information from federal, state, and local government records from protected information.

Not all Businesses are Impacted by the CPRA

While businesses in the state may want to become familiar with these new regulations, the CCPA, as amended by the CPRA, only applies to certain businesses and contains other exemptions.

Specifically, the CPRA does not generally apply to government agencies or nonprofit organizations, and only applies to for-profit businesses that:

• Have a gross annual revenue of over $25 million;
• Buy, sell, or share the personal information of 100,000 or more California residents, households, or devices; or
• Derive 50% or more of their annual revenue from selling California residents’ personal information.

The CPRA also identifies several categories of businesses, including credit reporting agencies, that are exempt from the requirements of the CPRA.  And businesses outside of California may also want to be aware that the International Association of Privacy Professionals reports that other states have similar bills in various stages of legislation concerning consumer privacy – and data privacy generally. Consult your attorney to find out how this amendment, or other laws, may affect you.