CPRA Rivals GDPR's Privacy Protections While Emphasizing Consumer Choice

The newly passed Proposition 24, the California Privacy Rights Act (CPRA), represents the second time in two years that California has instituted a comprehensive privacy statute that fundamentally changes data privacy practices for most enterprises doing business in California. While the CPRA builds on many of the provisions of the California Consumer Privacy Act (CCPA) of 2018, the differences between the two statutes are significant. Several of the new CPRA provisions are based on General Data Protection Regulation (GDPR) principles with an eye toward obtaining an adequacy decision from the European Commission. While balancing transparency, choice and flexibility for technological development, the CPRA also contains unique elements that set it apart from any privacy statute in the world.