The California Privacy Rights Act – what it means for consumers and businesses

CPRA expands the rights of California residents to control their personal information, including the right to correct inaccurate information, the right to limit the use of sensitive information and the right to opt-out of the sale or sharing of their personal information.

CPRA imposes additional obligations on businesses that collect and use personal information, including the requirement to conduct regular risk assessments and to implement data minimization practices. It also creates a new enforcement agency, the California Privacy Protection Agency (CPPA), which will have the authority to enforce the law and impose fines for non-compliance.

While CPRA applies specifically to California residents, its impact will be felt by businesses outside of California that collect personal information from California residents. This is because CPRA requires businesses to extend the same privacy rights to California residents, regardless of where the business is located.

CPRA expands the definition of information to include new categories such as precise geolocation data, race, ethnicity and health information.

The CPRA introduces new requirements for businesses to limit the retention of consumers’ personal information. Businesses must inform consumers about the length of time they intend to retain personal data and must not retain it for longer than necessary.

CPRA increases the potential liability for businesses in the event of a data breach, requiring them to implement reasonable security measures and imposing penalties for failure to do so.