On May 27, the California Privacy Protection Agency (CPPA) released its draft regulations for the California Privacy Rights Act (CPRA).
The CPRA will replace the California Consumer Privacy Act (CCPA) which was released in August 2020.
Changes to the CCPA include some of the following:
Key concept and definitions (e.g. disproportionate effort, financial incentive, notice of right to limit, opt-out preference signal, request to limit/opt-in/opt-out/share…)
Restrictions on the use and collection of personal information
Requirements for disclosures and communications to consumers
Requirement for methods for submitting CCPA requests and obtaining consumer consent
Required disclosures to consumers including the provision of a notice of right to limit or an alternative opt-out link
Notice of right to opt-out of sale/sharing and the ‘Do not sell or share my personal information’ link. Notice of right to limit and ‘limit the use of my personal information’ link.
Alternative opt-out link
Notice of financial incentive
Methods for submitting requests to delete, correct and to know. Timeline for responding to requests to delete, correct and to know
Opt-out preference signals
Requests to opt-out of sale/sharing
Requests to limit use and disclosure of personal information
Contracts requirements for service providers and contractors
General and contracts requirements for third parties
Requirements relating to the request to delete, correct and know
Requirement regarding consumers under 16 years of age
The changes are scheduled to be effective by January 1, 2023.