Alphabet Soup

The California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) constitute a potent one-two punch by Golden State regulators, and a model for other states’ data privacy legislation. According to Bloomberg Law, the California laws are changing the way companies do business. The CPRA amends the CCPA. Most of its provisions become operative on Jan. 1, 2023. The CCPA became law in June 2018. It creates a long list of consumer privacy rights and business obligations in respect to collection and sale of personal information, and vests the California Attorney General with enforcement authority. The CPRA grants a new agency, the California Privacy Protection Agency, “full administrative power, authority, and jurisdiction to implement and enforce” the CCPA, but the Attorney General still retains enforcement powers. Enforcement begins on July 1, 2023, and will apply only to violations occurring on or after that date. The CCPA’s provisions remain in effect and enforceable until that date. The Bloomberg article referenced above analyzes both CCPA and CPRA exhaustively, and lists consumers’ rights under the legislation.