What is CPRA (California Privacy Rights Act)?

The CPRA is not a separate statute so much as CCPA 2.0: it amends the same code sections, and 'CCPA as amended by the CPRA' is the law actually in force. Voters approved it as Proposition 24 in November 2020, and its principal provisions became operative on January 1, 2023, applying to personal information collected from January 1, 2022.

Its substantive additions map closely to GDPR concepts. It created the category of 'sensitive personal information' — government identifiers, precise geolocation, racial or ethnic origin, religious beliefs, biometric and health data, sexual orientation, and message contents — with a consumer right to limit its use. It added the right to correct inaccurate information, and imported principles of data minimization, purpose limitation, and storage limitation into California law. Most consequentially for marketers, it defined 'sharing' as disclosure for cross-context behavioral advertising, extending the opt-out beyond monetary 'sales' to ordinary ad-tech data flows.

Institutionally, the CPRA created the California Privacy Protection Agency (CPPA) — the first US regulator dedicated to privacy — with rulemaking and administrative enforcement power alongside the Attorney General. It also removed the CCPA's automatic 30-day cure period, so businesses can no longer fix violations after notice as a matter of right, and it extended obligations to service providers and contractors through mandatory contract terms.

For consent design, one CPRA definition does outsized work: consent obtained through dark patterns 'does not constitute consent.' California regulators now review interface design itself, screenshotting banners and opt-out flows as evidence.