When California voters approved Proposition 24, the California Privacy Rights Act (CPRA), on November 3, 2020, the result was to substantially amend the California Consumer Privacy Act (CCPA) which became effective only 10 months earlier. We outlined the basic rules for determining when the CCPA applies, and summarize here the changes made by the CPRA.
Some of the requirements for the CCPA to apply remain the same, namely that a “business” (i) do business in the State of California, (ii) collect personal information (or on behalf of which such information is collected), and (iii) alone or jointly with others determines the purposes or means of processing of that data. However, a “business” under the CCPA also must satisfy at least one of three additional requirements which were modified by the CPRA as follows:
