Privacy & Information Security Law Blog

On November 3, 2020, California voters approved California Proposition 24, the California Privacy Rights Act (“CPRA”). As we previously reported, the CPRA significantly amends and expands upon the California Consumer Privacy Act of 2018, which became enforceable earlier this year. The new and modified obligations under the CPRA will become operative on January 1, 2023, and, with the exception of access requests, will apply to personal information collected by businesses on or after January 1, 2022. Notably, the CPRA establishes the California Privacy Protection Agency, which will be responsible for enforcing and implementing consumer privacy laws and imposing administrative fines, making California the first state in the U.S. with a privacy-specific regulator.