California voters passed
Proposition 24 in last week's general election to adopt the
California Privacy Rights Act of 2020 (CPRA), which amends the
California Consumer Privacy Act of 2018 (CCPA) in several ways
intended to enhance consumer privacy protections. The CPRA becomes
effective on January 1, 2023, except for certain provisions that
will take effect on January 1, 2021. In the interim, the CCPA will
remain in full force and in effect.
At a high level, the CPRA brings California's landmark
privacy law closer to the E.U.'s General Data Protection
Regulation (GDPR). For instance, the CPRA introduces GDPR-like
principles, requiring that a business's collection, use,
retention, and sharing of personal information be "reasonably
necessary and proportionate to achieve the purposes for which the
personal information was collected or processed, or for another
disclosed purpose that is compatible with the context in which the
personal information was collected, and
