On November 3, voters in California approved Proposition 24 to pass the California Privacy Rights Act (CPRA). The final result was closer than pre-election polls suggested, but 56% of voters approved the measure, nonetheless.
CPRA builds on the California Consumer Privacy Act (CCPA). When it takes effect in January 2023, CPRA will enshrine a tougher set of data privacy rules for businesses, give consumers more rights on how their data can be used, and establish a separate agency for rule-making and enforcement called the California Privacy Protection Agency (CPPA). More precisely, CPRA would:
For marketers already struggling to meet compliance deadlines for CCPA, CPRA represents another legal hurdle, and one that will be lot more onerous than what they currently face, at least for large marketers who have data on more than 100,000 households (as opposed to the 50,000 threshold under CCPA). If the act goes into effect in 2023, most personalized advertising will no longer be possible in California, and many parts of the data ecosystem will struggle to adapt.
The long lead time until the law takes effect, however, gives businesses time to adapt. It also puts additional pressure on the federal government to come up with a national data privacy law that may supersede it. “I think that CPRA’s most impactful provision is when it takes effect: January 2023,” said Caitlin Fennessy, research director at the International Association of Privacy Professionals (IAPP), prior to its passage. “CPRA would create the impetus and provide the time frame for adoption of federal privacy legislation. And I think that was intentional on the part of the ballot initiatives’ proponents.”