California Privacy Rights Act (CPRA)
The 2023 amendment to the CCPA that strengthened consumer privacy protections and created the California Privacy Protection Agency.
The California Privacy Rights Act (CPRA) is a ballot initiative approved in November 2020 that significantly amended the CCPA, with most provisions taking effect January 1, 2023. The CPRA introduced several new concepts: a sensitive personal information category with additional protections, the right to correct inaccurate personal information, data minimization and purpose limitation requirements, expanded opt-out rights to cover sharing (not just selling) of personal information, and the creation of the California Privacy Protection Agency (CPPA) as the first dedicated state privacy enforcement body.
Key changes from the original CCPA include the expanded definition of opt-out to cover "sharing" data for cross-context behavioral advertising (not just direct sale), new thresholds for applicability, mandatory contract requirements for service providers and third parties, and enhanced requirements for businesses processing data of individuals under 16. The CPRA also introduced the concept of "Do Not Sell or Share My Personal Information," broadening the original CCPA requirement. The CPPA has begun active enforcement and rulemaking, establishing itself as a significant regulatory body alongside the California Attorney General.