The California Privacy Rights and Enforcement Act of 2020 (the “CPRA”) expands the privacy rights and protections provided to California consumers pursuant to existing state law, including the California Consumer Privacy Act of 2018 (the “CCPA”). Businesses that are subject to the CPRA must comply with various notice obligations and requirements related to the collection, deletion, sale and sharing of personal information.

This client alert provides a summary of some of the CPRA’s changes to the CCPA, the creation of the California Privacy Protection Agency and the effective date of the CPRA. This is simply a summary of some key points so check with your ECJ attorney for the critical details regarding the CPRA.

Changes to the CCPA

The CPRA expands and amends the CCPA in several respects. A few of the key changes are summarized below.

• Covered Business:
  • If a for-profit business doing business in California collects, transfers or sells personal information and had annual revenue in excess of $25 million in the preceding calendar year, it is still a covered business. The CPRA clarified that the $25 million annual revenue must be from the “preceding calendar year.”
  • Under the CCPA, a business that annually buys, sells or shares personal information for commercial purposes from 50,000 consumers, households or devices is a covered business. However, the CPRA increases the number of consumers and households from 50,000 to 100,000, and eliminates “devices” altogether from this prong of the definition. Therefore, under the CPRA, if a business annually buys, sells or shares the personal information of 100,000 or more consumers or households, it is a covered entity.
  • In addition, the CCPA threshold that subjected a business that derives 50% or more of its annual revenues from selling consumers’ personal information was expanded to include either the selling or sharing of such personal information. Under the CPRA, “sharing” means sharing, renting, releasing, disclosing, disseminating, making available, transferring or otherwise communicating a consumer’s personal information to a third party for cross-context behavioral advertising, whether for monetary or other valuable consideration, including transactions between a business and a third party for cross-context behavioral advertising for the benefit of a business in which no money is exchanged.
• Sharing of Personal Information: The CPRA allows consumers to opt-out of the “sharing” of personal information, not just the “sale” of such information. Therefore, consumers have the right to opt-out of both the selling and sharing of their personal information to third parties for cross-context behavioral advertising. To that end, the “do not sell” button on a covered business’ homepage will likely evolve to a “do not sell and do not share” button.
• Sensitive Personal Information: A new category of personal information defined as “sensitive personal information” has been created and consumers may direct a covered business to use their sensitive personal information only as necessary to provide certain goods or services. “Sensitive personal information” includes a consumer’s social security number, financial information, precise geolocation, racial or ethnic origin, and sexual orientation.
• Minors: A covered business must obtain permission before collecting data from consumers under the age of 16 (i.e. an “opt-in” requirement from consumers under the age of 16) and must obtain permission from a parent or guardian before collecting data from consumers under the age of 13 (i.e. an “opt-in” from parents of consumers under the age of 13). The CCPA’s provisions regarding minors related only to the sale of a minor’s personal information, not the mere act of collection from such minors.
• Additional Disclosures: Under the CPRA, a covered business must also make additional disclosures in its privacy documents, including the length of time they will retain personal information, whether personal information is shared and the purposes for which sensitive personal information is collected or used.

California Privacy Protection Agency

The CPRA creates a new state agency, the California Privacy Protection Agency (the “Agency”), which will be responsible for enforcing California data privacy laws. The Agency will be governed by a five-member board and is charged with adopting regulations to implement the CPRA.

Effectiveness and Enforcement

Most of the CPRA’s provisions will not become effective until January 1, 2023, with enforcement beginning on July 1, 2023. This provides businesses with just over two years to review and update their privacy policies and practices to comply with this robust new law.