Overview: California Consumer Privacy Act

California privacy law is going through an evolutionary phase which is expected to continue for the next several years. The primary focus of California privacy law is to protect and regulate the use of personal information of consumers that is collected by businesses. California privacy law is being implemented through legislative action, regulations and voter-passed propositions.

There have been two significant recent events in the development of California privacy law. The first was passage of the California Consumer Privacy Act (CCPA) by the state legislature in 2018. The CCPA became effective on January 1, 2020, and enforcement began on July 1, 2020. The CCPA is currently enforced by the California Office of the Attorney General (OAG). Since its passage, the Office of Administrative Law (OAL) of the OAG has proposed and then modified a set of regulations to provide guidance to businesses on how to comply with the CCPA, and to enable consumers to exercise new rights over their personal information. A final set of regulations were promulgated on August 14, 2020, and final amendments to the regulations became effective on March 15, 2021 – find the CCPA regulations here.

The second significant event was the passage of a California ballot measure (Proposition 24) approved by California voters in November 2020, which created the California Privacy Rights Act (CPRA). The CPRA changes and expands many of the rights and obligations established under the CCPA, and will take effect on January 1, 2023. The CPRA created a new investigative, enforcement and rulemaking authority called the California Privacy Protection Agency (CPPA).

The CCPA currently applies to businesses that either (1) have annual revenue of at least $25 million [or are owned or controlled by such an entity]; or (2) buy, sell or share personal information of at least 50,000 California consumers or households for commercial purposes; or (3) derive more than half of their annual revenue from the sale of personal information. When implemented in 2023, the CPRA will change these criteria, expanding the threshold number of consumers or households from 50,000 to 100,000, and expanding the 50% of annual revenue to include revenue derived from either selling or sharing personal information.

This article is intended to be the first in a series of articles that Sierra IP Law, PC - Patents, Trademarks & Copyrights will publish to provide information regarding the critical aspects of the CCPA and CPRA.