The California Privacy Rights Act (the CPRA) is an amendment to the California Consumer Privacy Act (CCPA). It went into effect on January 1, 2023. It doesn’t replace the CCPA - it just adds to it, and places more obligations on companies and adds rights for consumers.  

‍

Here are a few of the most important things the CPRA includes:

First, the CPRA adds new individual rights, most notably, the right to have inaccurate information corrected. 

Second, the CPRA adds a right to opt out of the sale and sharing of personal information. This includes the transfer of personal information of personal information targeted advertisements.

Third, the CPRA adds a new class of personal information called sensitive personal information. Sensitive personal information includes:

• Social Security, driver’s license, state ID, or passport numbers
• Financial account information
• Precise geolocation
• Racial or ethnic origin
• Sex life or sexual orientation
• Religious or philosophical beliefs
• Union membership
• Nonpublic communication (including mail, email, and text content)
• Genetic, biometric, and health data

The collection of sensitive personal information carries additional disclosure, opt-out, and use requirements. Specifically, consumers have the right to limit the use of their sensitive personal information.

Fourth, it now includes employee personal information and B2B personal information (information from people who work at companies a business gathers data on).  

‍

These categories were exempted from the CCPA - but not anymore. There are a number of other changes to the CCPA, but these are the big ones - and are now fully a part of California’s privacy laws.