California Consumer Privacy Laws

What are the CCPA and CPRA?

The California Consumer Privacy Act (CCPA), signed into law on June 28, 2018, creates an array of consumer privacy rights and business obligations regarding the collection and sale of personal information. The CCPA went into effect Jan. 1, 2020.

The California Privacy Rights Act (CPRA), also known as Proposition 24, was a ballot measure approved by California voters on Nov. 3, 2020. It significantly amended and expanded the CCPA, and it is sometimes referred to as “CCPA 2.0.”

Compare the consumer rights provided by both the CCPA and CPRA. Explore why these two laws are having a profound impact on the privacy and data security landscape and how they’re changing the way companies do business.

Where is the CCPA codified?

The CCPA is codified at Cal. Civ. Code § 1798.100 et seq.

Are there accompanying regulations?

Yes, the regulations are found at 11 CCR §§ 7000 et seq. The CCPA authorizes the California attorney general to adopt regulations pursuant to Cal. Civ. Code § 1798.185.

When did the CPRA take effect?

The CPRA took effect on Dec. 16, 2020, but most of the provisions revising the CCPA didn’t become “operative” until Jan. 1, 2023.

Does the CPRA replace the CCPA?

Not exactly. The CPRA is more accurately described as an amendment of the CCPA. The CPRA specifically states that it “amends” existing provisions of Title 1.81.5 of the California Civil Code (currently known as the CCPA) and “adds” new provisions (related to the establishment of the California Privacy Protection Agency).

Who enforces the CCPA and CPRA?

The CCPA vests the California attorney general with enforcement authority. Although the CPRA grants the California Privacy Protection Agency “full administrative power, authority, and jurisdiction to implement and enforce” the CCPA, the attorney general still retains enforcement powers. Cal. Civ. Code § 1798.199.90 provides that the California Privacy Protection Agency “may not limit the authority of the attorney general to enforce this title.”

When will enforcement of the CPRA begin?

Enforcement of the CPRA began July 1, 2023, and enforcement will apply only to violations occurring on or after that date. It should be noted, however, that the CCPA’s provisions remain in effect and enforceable until that date. The first enforcement action of the CCPA was announced in August 2022.

What is the California Privacy Protection Agency?

The California Privacy Protection Agency is a new agency created by the CPRA, which is vested with “full administrative power, authority, and jurisdiction to implement and enforce” the CCPA.

When does the California Privacy Protection Agency assume rulemaking authority?

The CPRA transferred rulemaking authority from the California attorney general to the California Privacy Protection Agency effective April 21, 2022. Final CPRA regulations were originally due by July 1, 2022, but the formal rulemaking deadline has been extended.

What rights do consumers have?

The CCPA created six specific rights for consumers:

1. The right to know (request disclosure of) personal information collected by the business about the consumer, from whom it was collected, why it was collected, and, if sold, to whom;
2. The right to delete personal information collected from the consumer;
3. The right to opt out of the sale of personal information (if applicable);
4. The right to opt-in to the sale of personal information of consumers under the age of 16 (if applicable)
5. The right to nondiscriminatory treatment for exercising any rights; and
   the right to initiate a private cause of action for data breaches.

The CPRA created two additional rights:

7. The right to correct inaccurate personal information.
8. The right to limit use and disclosure of sensitive personal information.

Who is a ‘consumer’?

A consumer is a natural person who is a California resident, as defined in the state’s tax regulations, however identified, including by any unique identifier.

What is a consumer’s ‘personal information’?

The CCPA defines “personal information” as information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal information includes, but is not limited to, the following:

1. Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier, internet protocol address, email address, account name, Social Security number, driver’s license number, passport number, or other similar identifiers.
2. Any categories of personal information described in Civ. Code § 1798.80(e).
3. Characteristics of protected classifications under California or federal law.
4. Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
5. Biometric information.
6. Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumer’s interaction with an internet website, application, or advertisement.
7. Geolocation data.
8. Audio, electronic, visual, thermal, olfactory, or similar information.
9. Professional or employment-related information.
10. Education information, defined as information that is not publicly available, personally identifiable information as defined in the Family Educational Rights and Privacy Act (20 U.S.C. Sec. 1232g; 34 C.F.R. Part 99).
11. Inferences drawn from any of the information identified in this subdivision to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.

Personal information does not include publicly available information, consumer information that is deidentified, or aggregate consumer information.

What is a consumer’s ‘sensitive personal information’?

Sensitive personal information (SPI) is a subset of personal information newly defined in the CPRA. SPI is personal information that reveals:

• a consumer’s Social Security, driver’s license, state identification card, or passport number.
• a consumer’s account login, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account.
• a consumer’s precise geolocation.
• a consumer’s racial or ethnic origin, religious or philosophical beliefs, or union membership.
• the contents of a consumer’s mail, email, and text messages, unless the business is the intended recipient of the communication.
• a consumer’s genetic data.

SPI also includes:

• the processing of biometric information for the purpose of uniquely identifying a consumer.
• personal information collected and analyzed concerning a consumer’s health.
• personal information collected and analyzed concerning a consumer’s sex life or sexual orientation.

SPI that is publicly available shall not be considered sensitive personal information or personal information.

What constitutes a ‘sale’ of personal information?

The CCPA defines a “sale” as selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to another business or a third party for monetary or other valuable consideration.

What does ‘sharing’ personal information mean?

The CPRA defines “sharing” as renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, including transactions between a business and a third party for cross-context behavioral advertising for the benefit of a business in which no money is exchanged.