CPRA: The Complete Guide
The California Privacy Rights Act, passed by California voters as Proposition 24 in November 2020, significantly strengthens and amends the CCPA. Effective January 1, 2023, the CPRA introduces new consumer rights, creates a dedicated enforcement agency, and imposes obligations that more closely align California's privacy regime with the GDPR.
What the CPRA Adds
The CPRA introduces several concepts absent from the original CCPA. It creates the category of "sensitive personal information" — including Social Security numbers, precise geolocation, racial or ethnic origin, and biometric data — and grants consumers the right to limit its use. New rights also include the right to correct inaccurate information and the right to opt out of automated decision-making technology.
The law codifies data minimization and purpose limitation principles, requiring businesses to collect only personal information that is reasonably necessary and proportionate to the disclosed purpose. It also extends the lookback period for consumer requests to twelve months.
The California Privacy Protection Agency
The CPRA established the California Privacy Protection Agency (CPPA), the first dedicated state privacy enforcement body in the United States. The CPPA has rulemaking authority and administrative enforcement power, supplementing the California Attorney General's existing enforcement role.
Who Needs to Comply
The CPRA modifies the CCPA's applicability thresholds. It applies to for-profit businesses that collect California residents' personal information and meet one of three criteria: annual gross revenue over $25 million, buying, selling, or sharing personal information of 100,000 or more consumers or households, or deriving 50% or more of annual revenue from selling or sharing consumers' personal information.
Practical Compliance Steps
- Gap assessment — Identify new CPRA requirements beyond existing CCPA compliance
- Sensitive data inventory — Map all sensitive personal information processing
- Consumer rights updates — Implement correction and automated decision-making opt-out mechanisms
- Data minimization review — Evaluate collection practices against necessity and proportionality
- Vendor agreements — Update contracts to reflect CPRA requirements for service providers, contractors, and third parties
- Cybersecurity audit program — Establish annual audit procedures if processing presents significant risk
- Risk assessments — Conduct and document assessments for high-risk processing activities
Organizations already compliant with the CCPA have a head start, but the CPRA's expanded requirements — particularly around sensitive data, data minimization, and audit obligations — demand additional compliance investment.