On May 27, the California Privacy Protection Agency (CPPA) released its draft regulations for the California Privacy Rights Act (CPRA).

The CPRA will replace the California Consumer Privacy Act (CCPA) which was released in August 2020.

Changes to the CCPA include some of the following:

• Key concept and definitions (e.g. disproportionate effort, financial incentive, notice of right to limit, opt-out preference signal, request to limit/opt-in/opt-out/share…)

• Restrictions on the use and collection of personal information

• Requirements for disclosures and communications to consumers

• Requirement for methods for submitting CCPA requests and obtaining consumer consent

• Required disclosures to consumers including the provision of a notice of right to limit or an alternative opt-out link

• Requirements relating to the privacy policy (content, disclosure, format of disclosure, channel of disclosure…)

• Notice of right to opt-out of sale/sharing and the ‘Do not sell or share my personal information’ link. Notice of right to limit and ‘limit the use of my personal information’ link.

• Alternative opt-out link

• Notice of financial incentive

• Methods for submitting requests to delete, correct and to know. Timeline for responding to requests to delete, correct and to know

• Opt-out preference signals

• Requests to opt-out of sale/sharing

• Requests to limit use and disclosure of personal information

• Contracts requirements for service providers and contractors

• General and contracts requirements for third parties

• Requirements relating to the request to delete, correct and know

• Requirement regarding consumers under 16 years of age

The changes are scheduled to be effective by January 1, 2023.