Golden State GDPR: What The Edtech Industry Should Know About CA's New Privacy Rules

On June 27, 2018, the California Legislature, in a flurry of last-minute activity, passed the California Consumer Privacy Act of 2018 (CCPA). Governor Jerry Brown signed the bill into law on the same day, and the CCPA is set to become effective on January 1, 2020.

This is a game-changing law that will impact companies in the U.S. and globally, and moves the U.S. toward closer alignment with the European Union, where the General Data Protection Regulation ("GDPR") went into effect in May.

As a reminder, GDPR updated the privacy framework in the EU on a variety of fronts, expanded its territorial scope to cover a large swath of the global digital economy, and grabbed headlines with its potentially massive fines for violations (up to 4 percent of annual worldwide revenue, or €20 million.) GDPR mandated increased transparency and individual control over personal data. It also developed individual rights to "be forgotten," and enhanced obligations for internal