What did the CPRA change about my privacy rights?

What the Law Says

The California Privacy Rights Act (CPRA), which amended the CCPA, created new consumer rights, imposed stricter obligations on businesses, and established the California Privacy Protection Agency (CPPA) to enforce the law.

The CPRA added four new rights: the right to correct inaccurate personal information; the right to limit use and disclosure of sensitive personal information; the right to opt out of automated decision-making technology (including profiling); and the right to know how long a business plans to retain your personal information.

It also redefined 'personal information' to include 'sensitive personal information' — such as Social Security numbers, precise geolocation, racial or ethnic origin, religious beliefs, union membership, mail/email contents, genetic data, biometric data, health information, and sexual orientation — subject to special use restrictions.

Businesses must now provide a 'Limit the Use of My Sensitive Personal Information' link alongside the existing 'Do Not Sell My Personal Information' link. They may only collect or use sensitive personal information for limited, specified purposes unless you explicitly consent.

The CPRA also extended the time businesses have to respond to consumer requests from 45 days to up to 90 days — but only if they notify you within the initial 45-day period and explain the delay.

Statutory Text

A consumer shall have the right to request that a business correct any inaccurate personal information about the consumer that the business has collected.

— Cal. Civ. Code § 1798.106(a) — Right to Correction

Statutory Text

A consumer shall have the right to limit the use of the consumer’s sensitive personal information to that use which is necessary to perform the services or provide the goods reasonably expected by an average consumer who requests such goods or services.

— Cal. Civ. Code § 1798.121(a) — Right to Limit Use of Sensitive PI

Statutory Text

The agency shall have full administrative power, authority, and jurisdiction to implement and enforce the provisions of this title.

— Cal. Civ. Code § 1798.199.10(a) — CPPA Enforcement Authority

Sources