California Privacy Rights Act

This article is about a privacy and data protection law in California. For the other California law also abbreviated CPRA, see California Public Records Act.

The California Privacy Rights Act of 2020 (CPRA), also known as Proposition 24, is a California ballot proposition that was approved by a majority of voters after appearing on the ballot for the general election on November 3, 2020.^[1][2][3] This proposition expands California's consumer privacy law and builds upon the California Consumer Privacy Act (CCPA) of 2018, which established a foundation for consumer privacy regulations.^[4]

Proposition 24

November 3, 2020 (2020-11-03)
Privacy Rights and Enforcement Act Initiative
Results
Choice Votes % Yes 9,384,125 56.23% No 7,305,026 43.77%
For   60%–70%   50%–60% Against   60%–70%   50%–60%

The proposition enshrines more provisions in California state law, allowing consumers to prevent businesses from sharing their personal data, correct inaccurate personal data, and limit businesses' usage of "sensitive personal information", which includes precise geolocation, race, ethnicity, religion, genetic data, private communications, sexual orientation, and specified health information. The Act creates the California Privacy Protection Agency as a dedicated agency to implement and enforce state privacy laws, investigate violations, and assess penalties of violators.^[5] The Act also removes the set time period in which businesses can correct violations without penalty, prohibits businesses from holding onto personal data for longer than necessary, triples the maximum fines for violations involving children under the age of 16 (up to $7,500), and authorizes civil penalties for the theft of specified login information.^[6][7]

The California Privacy Rights Act took effect on January 1, 2023, applying to personal data collected on or after January 1, 2022.^[8] The law cannot be repealed by the state legislature, and any amendments made by the legislature must be “consistent with and further the purpose and intent” of the Act.^[9]

Background

The initiative represents an expansion of provisions first laid out by the California Consumer Privacy Act. In addition to the consumer protections, the proposition creates the California Privacy Protection Agency.^[4] The agency will share consumer privacy oversight and enforcement duties with the California Department of Justice.^[4] Another effect of the initiative is requiring businesses to obtain permission from consumers younger than 16 before collecting their data and permission from a parent or guardian before collecting data from consumers younger than 13.^[10]

Intentions of the Act

The intentions of the Act are to provide California residents with the right to:

1. Know who is collecting their and their children's personal information, how it is being used, and to whom it is disclosed.
2. Control the use of their personal information, including limiting the use of their sensitive personal information.
3. Have access to their personal information and the ability to correct, delete, and transfer their personal information.
4. Exercise their privacy rights through easily accessible self-serve tools.
5. Exercise their privacy rights without being penalized.
6. Hold businesses accountable for failing to take reasonable information security precautions.
7. Benefit from businesses' use of their personal information.
8. Have their privacy interests protected even as employees and independent contractors.^[2]

Polls

Poll source	Date(s) administered	Sample size^[a]	Margin of error	For Proposition 24	Against Proposition 24	Undecided
Goodwin Simon Strategic Research/YES on Prop 24^[A]	September 29 – October 5, 2020	750 (LV)	–	77%	11%	12%
Redfield & Wilton Strategies	September 19–21, 2020	1,915 (LV)	–	60%	17%	23%
Goodwin Simon Strategic Research/YES on Prop 24^[A]	July 26–31, 2020	– (V)^[b]	–	81%	11%	8%

Results

The proposition passed with roughly 55% of California voters voting in favor of the measure.^[11]

Notes

1. Key:
   A – all adults
   RV – registered voters
   LV – likely voters
   V – unclear
2. Not yet released

Partisan clients

1. Poll sponsored by a campaign which supported Proposition 24 prior to this poll's sampling period

References

1. Dustin, Gardiner (September 21, 2020). "California's Proposition 24 would protect data-privacy law from being weakened in Legislature". San Francisco Chronicle. Retrieved September 24, 2020.
2. "Text of Proposed Laws - Proposition 24" (PDF). California Secretary of State.
3. Hooks, Chris Nichols, Kris. "What We Know About California Proposition Results". www.capradio.org. Retrieved 2020-11-11.{{cite web}}: CS1 maint: multiple names: authors list (link)
4. "California Consumer Privacy Act (CCPA)". State of California - Department of Justice - Office of the Attorney General. 2018-10-15. Retrieved 2020-11-09.
5. "California Proposition 24: New rules for consumer data privacy". CalMatters. 9 September 2020. Retrieved 2020-11-09.
6. "California Proposition 24, Consumer Personal Information Law and Agency Initiative (2020)". Ballotpedia. Retrieved September 24, 2020.
7. "Proposition 24 Official Title and Summary | Official Voter Information Guide | California Secretary of State". voterguide.sos.ca.gov. Retrieved 2020-12-10.
8. "Move Over, CCPA: The California Privacy Rights Act Gets the Spotlight Now". news.bloomberglaw.com. Retrieved 2020-12-10.
9. "The California Privacy Rights Act (CPRA) Has Been Enacted into Law". www.paulhastings.com. Retrieved 2020-12-10.
10. "Qualified Statewide Ballot Measures". Secretary of State of California. Retrieved July 2, 2020.
11. Morrison, Sara (2020-11-03). "Live results for California's data privacy ballot initiative". Vox. Retrieved 2020-11-08.

California Privacy Rights Act - CPRA