California Privacy Rights Act (CPRA)

The CPRA amended the CCPA and took full effect January 1, 2023. It significantly raised the compliance bar for businesses operating in California, introducing several provisions that moved California's privacy framework closer to the GDPR.

Key additions include:

• A new right to correct inaccurate personal information.
• Expanded rights around sensitive personal information, covering data like Social Security numbers, precise geolocation, and financial account information.
• Data minimization and purpose limitation requirements.
• New obligations around automated decision-making, including the right to opt out of profiling in certain contexts.

The CPRA also established the California Privacy Protection Agency to take over rulemaking and enforcement authority from the Attorney General, created a mandatory data protection assessment framework for high-risk processing activities, and extended covered rights to employees and business contacts.