Franchisor Compliance With California Privacy Laws

California passed a landmark privacy law, the CCPA, that took effect in 2020. Among other things, it explicitly applies to companies that meet certain size thresholds and that collect or process the personal information of California residents. The CCPA also provided that certain jointly-controlled companies that share common branding could be required to comply with the CCPA.

Starting 1/1/2023, the CCPA will undergo significant updates (collectively, "CPRA"). Although the CPRA will make certain compliance obligations more onerous, it has created some breathing room regarding which businesses it covers. Franchisors especially may wish to review their franchisee relationships to see if they meet any of the various tests to be considered regulated "businesses" for California privacy purposes. If they could be considered "businesses," they may have privacy obligations to consumers and other individuals. Non-compliance can create significant financial exposure.