On November 3, California voters approved Proposition 24, which implements changes to the California Consumer Privacy Act (CCPA). The new initiative, the California Privacy Rights Act (CPRA), and some of the changes it makes include additional protections for consumers’ privacy rights and establishment of a new state agency tasked with enforcing California’s privacy laws. The new provisions of Proposition 24 will go into effect on January 1, 2023, when it effectively replaces the CCPA, and additional requirements are expected to be provided by the California Privacy Protection Agency.

One change introduced by the CPRA is the scope of the state’s privacy regulations. The CCPA threshold of companies that handled personal information was doubled from 50,000 or more Californians to 100,000 or more. And while the CCPA includes companies that receive, a relatively broad term, the personal information of Californians for commercial purposes, CPRA’s scope only includes companies that buy, sell or share that personal information.

Proposition 24 also extended the definition of “business” to joint ventures and partnerships consisting of businesses in which each party has a 40 percent share. It clarifies that definition further by stating that a company’s parent or subsidiary is only in the scope of the CPRA if personal information is shared with the parent or subsidiary. The CPRA also limits what’s considered personal information. “Publicly available” information, like information individuals publish on social media or “truthful information that is a matter of public concern,” is not included.

For more information on the changes included in Proposition 24 and the CPRA, click here.