CPRA enforcement has gone through many twists and turns over the years, and it’s completely reasonable to be a bit confused about what’s happened.
After a last-minute reversal, the CPRA is fully enforceable as of July 1, 2023.
Some may have heard that CPRA enforcement had been delayed until March 29, 2024; others may have thought that the CPRA was already enforceable. The reality is... complicated.
Most of the CPRA came into force on January 1, 2023. However, only the statutory requirements of the CPRA and the regulatory requirements of the previous California Consumer Privacy Act (CCPA) were enforceable. In essence, only the requirements defined in the text of the CPRA itself and the regulations and rules developed around the earlier CCPA were enforceable. That’s why the California attorney general was able to go after Sephora for CCPA violations, even though the CPRA hasn’t been fully enforceable until recently.
Some issues (like data privacy) are too expansive and complicated to effectively manage with just one fixed set of requirements defined in the text of a law. In these cases, another state or federal authority makes rules that comprise the law’s regulatory (as opposed to statutory) requirements. In regard to the CPRA, that authority is the California Privacy Protection Agency (CPPA). This agency has been making additional rules to ensure the CPRA comprehensively and effectively regulates data privacy in California.
Unfortunately, the CPPA was late finalizing its rules and only wrapped them up in March of 2023. The California Chamber of Commerce sued, arguing that enforceability was always meant to kick in a year after rulemaking was finalized, so California courts delayed enforcement to March 29th, 2024. The CPPA filed an appeal at the time.
Again, this refers to the regulatory enforcement of the CPRA; not the statutory enforcement of the CPRA or the regulatory enforcement of the CCPA. That’s why the Sephora enforcement action could take place, even though CPRA enforcement hadn’t fully kicked in. Enforcement of the additional requirements developed by the CPPA had been delayed until March 29th, 2024.
Except California's Third District Court of Appeal threw us all for a loop. It granted the CPPA’s appeal. As a result, not only is the CPRA enforceable as of today, but it has been enforceable as of July 1, 2023—the original date when enforcement was meant to kick in.
Now that we’re all caught up on what happened with CPRA enforcement when and why, let’s answer some of the lingering questions we’ve been hearing about CPRA enforcement.
The state attorney general and the California Privacy Protection Agency (CPPA) have the right to levy fines against noncompliant businesses, including:
Each instance of improperly handled personal information counts as a violation, so these fines can quickly balloon to a serious level that has numbered in the millions of dollars in the past. Specifically, each impacted consumer is generally considered a “violation.”
We can look to historical examples of enforcement to determine what companies should expect. Thus far, only one company has been penalized under the CCPA/CPRA: Sephora. They were given a 30-day notice to address violations—which is no longer a mandatory aspect of the law, unfortunately. Now, whether or not to offer this cure period is up to the Attorney General and CPPA’s discretion.
Sephora failed to address these violations in time, however. They were fined $1.2 million for sending consumer data to external ad tech and analytics companies without giving consumers a way to opt out. You can learn more about this case in An Analysis of the Sephora Enforcement Action.
Without a doubt, the most frequent questions we receive from individuals and organizations center on whether or not the law applies to them. Let’s review the CPRA threshold criteria and dive deeper into its specifics.
As a reminder, the CPRA applies to your organization if you “do business” in the state of California and meet at least one of the following:
There are some important facts about these threshold criteria that are worth highlighting. First, the CPRA applies if you do business in California and meet any one of the three criteria listed above—so, if you earn $25 million in gross revenue and do business in California but don’t collect anybody’s personal information (which is, frankly, borderline impossible), you still need to comply.
So, what does it mean to “do business” in the state of California? The CPRA itself doesn’t define this term, but there is a broader legal definition of the term. From legal-explanations.com:
The term "doing business" refers to the regular activities a corporation undertakes, whether it is within the state of incorporation or in other states. The actions that constitute "doing business" can include a wide range of activities, such as selling products or services, maintaining a physical presence, or employing workers.
That’s pretty broad, so a good rule of thumb is if you think you do business in California, you probably do and may be subject to the CPRA as a result.
Importantly, this law is extra-territorial. So, even if you earned $25 million outside of California but still do business in the state and process Californians’ data, you’ll need to comply. It doesn’t matter whether your business is based in Canada, Kyrgyzstan, or the moon—you’ll still need to comply.
Another common misconception is that the CPRA doesn’t apply to B2B organizations.
There had been a period of time where personal information processed in the course of conducting due diligence regarding, providing a product or service to, or receiving a product or service from another business was exempt from the CPRA’s requirements. However, this exemption has since expired.
Now, if you collect or process an individual’s information—even if you’re just trying to get the business they work for to become a client or customer—then it still counts against the CPRA’s threshold criteria, and violations involving that individual’s data can still be enforced.
Non-profits are indeed exempt from the CPRA, though any revenue-generating or for-profit ventures or partnerships may trigger the need for compliance for that specific activity.
There are a number of other exemptions under the CPRA as well, including:
There used to be an exemption for data collected in an employment or commercial context, but this exemption was sunsetted on January 1, 2023—that means employees can exercise all of the rights afforded to them under the CPRA, and businesses must meet CPRA requirements around their employees’ data.
For a complete list of exemptions, see Section 15 of the CPRA.
As of this writing, the California Privacy Protection Administration (CPPA) has not finalized its formal rulemaking process for several key aspects of compliance, including risk assessments. However, it has released draft guidance on this subject, and we can look to how other laws handle privacy impact assessments (PIAs) to see what will likely be required.
And just because the rulemaking process for this isn’t complete, it’s still in your best interest to complete PIAs/risk assessments when advisable. At worst, it reduces the privacy risk in your processing activities; at best, it saves you from a fine applied retroactively.
According to the CPPA, organizations must conduct a PIA before engaging in activities that present a “significant risk” to privacy. Some example activities include:
At a minimum, a risk assessment should include:
For more information, see What Is a Privacy Impact Assessment (PIA) & How to Conduct One.
The CCPA’s original definition of the word “sell” created confusion, so the CPRA clarified the intended regulated activities by prohibiting both the sharing and selling of personal data should a consumer opt out. So, if a consumer asks your business not to share or sell their personal information, then you may not transfer that data to other entities, whether that’s for a monetary exchange, other valuable consideration, or even for free. Notably, this excludes the share of data for targeted advertising purposes.
To operationalize this requirement, businesses must have a link on their website reading “Do not share or sell my personal information,” which, when clicked, must force the business to do exactly that. So, for example, if a business uses third-party cookies, it may not drop those cookies on the browser of a consumer who has opted out.
The CPRA also requires businesses to allow consumers to opt out of certain uses of their sensitive personal information—this is a special category of data that could cause significant harm if it was mismanaged, such as social security numbers, race and ethnicity, gender identity, and so on. Businesses need to have a link reading “Limit the use of my sensitive personal information.”
While the Do Not Share/Sell link prohibits businesses from sharing or selling all kinds of personal information (including sensitive personal information), this link limits what businesses can do with sensitive personal information to a specific list of business purposes, which includes:
Now, stopping a business from sharing all personal information entirely would have a major impact on operations and could even prevent a business from functioning at all.
That’s why the CPRA requires data processing addendums with certain categories of vendors and/or partner organizations. These contractual addendums prevent organizations from misusing your consumers’ data. As a result, data transfers between your organization and these external parties are exempt from consumer opt-out requests. This way, critical business functions can continue to work as necessary, while potentially risky activities (like targeted advertising) remain prohibited.
You can learn more about data processing addendums under the CPRA in CPRA Compliance Checklist: 7 Key Steps.
Under the CPRA, data subjects have certain rights, including the right to:
When responding to a data subject request, businesses must comply within a 45-day window, with the option of a 45-day extension.
Now, for a long time, this information did not apply to individuals acting in a commercial capacity with the business—think employees, independent contractors, job applicants, and the like. So long as the business was collecting information related to that individual’s role, emergency contact, or benefits, then it was exempt from the CPRA’s DSAR requirements.
Other data privacy laws still have this exemption, but the CPRA sunsetted it on January 1, 2023. So, employee information is indeed subject to the CPRA’s requirements, including its DSAR requirements.
Universal opt-out signals are technologies that enable consumers to indicate their consent preferences once, rather than for each time they visit a new website. Most data privacy laws now require that businesses treat such signals as if the consumer had opted in or out of data collection on their website.
One of the more common signals is the Global Privacy Control (GPC), which functions as a browser extension.
In fact, one of the very first examples of CPRA enforcement involved a failure to honor GPC signals—Sephora was hit with a $1.2 million fine by the California attorney general for, among other things, transferring data without acknowledging consumer opt-outs made via the GPC.
The next logical question is, of course, how do you recognize GPC signals? You can find backend implementation information on the GPC website. But realistically, it’s easier to find a consent management platform that can handle the full spectrum of consent requirements, both in California and abroad.
Without a data privacy platform, becoming compliant with the CPRA and avoiding enforcement is going to be a challenge. Manual compliance is possible—but it’s more time-consuming, error-prone, and ultimately, riskier. Businesses interested in minimizing their risk and saving enough time to dedicate to revenue generation invest in data privacy platforms.
With the Osano Data Privacy Platform, you’ll be able to:
Schedule a demo of Osano today to see how it can help you reduce your risk now that CPRA enforcement is live.