CPRA (California Privacy Rights Act)

A 2020 California ballot initiative that substantially amended and expanded CCPA, effective January 2023. CPRA created new consumer rights including the right to correct inaccurate personal information and the right to limit use and disclosure of sensitive personal information. It established a new category of 'sensitive personal information' with enhanced protections, created the 'contractor' category for certain business relationships, expanded the definition of 'sale' to include 'sharing' for cross-context behavioral advertising, extended look-back periods for data retention obligations, and created the California Privacy Protection Agency as a dedicated enforcement body. CPRA also raised the threshold for triggering the law from 50,000 consumers/households/devices to 100,000. The law applies to businesses meeting CCPA thresholds and represents California's continued evolution as a privacy regulation leader, with implications beyond state borders as businesses often apply CPRA protections broadly.