The California Privacy Rights Act (CPRA) is a comprehensive rework of California’s paradigm-shifting 2018 consumer protection law (the California Consumer Privacy Act or CCPA) that was enacted through a ballot initiative on November 3, 2020, and will go into full effect on January 1, 2023.

It amends the CCPA in several material ways to, among other things, eliminate the existing carve-outs for data collected from job applicants,
employees and contractors, and for data of persons representing another business in connection with a business-to-business (B-to-B) transaction or communication. Those carve-outs expire on January 1, 2023. Further legislative extensions are unlikely, as the CPRA prohibits legislativeamendments that do not “enhance” privacy, though there could ultimately be somewhat different rules for these non-consumer data subjects. The CPRA retains a number of existing carve-outs for data covered by other state and federal privacy laws, such as protected healthcare information.

Click to learn more and download the PDF