California Privacy Rights Act (CPRA)

The CPRA is a new law that takes effect on January 1, 2023. It gives consumers in California certain rights regarding personal data, including access rights and opt-out rights for certain uses of their data. It also requires businesses to provide consumers with copies of their privacy policies upon request.

The CPRA applies only to companies doing business in California that collect “sensitive personal information” from California residents or otherwise engage in interstate commerce with them (such as through websites). This means that if a company doesn’t have any customers in California or doesn’t sell products or services there, then it doesn’t need to worry about complying with this law yet.

The CPRA requires businesses to notify consumers about how they collect and use personal information. The notice must be provided when the consumer first provides their personal information and every 12 months thereafter, unless the business changes its practices or makes material changes to how it collects and uses data.

The CPRA also prohibits most companies from selling people's personal information without their permission; however, some exceptions exist for disclosure of information used for law enforcement purposes or for financial fraud prevention purposes.