California voters approve significant CCPA changes

California voters have approved the California Privacy Rights Act (CPRA or Proposition 24), a new law coming into effect on January 1, 2023 that will significantly amend the California Consumer Privacy Act (CCPA). The CPRA will, among other things, modify existing consumer rights and create new rights—including a right to opt out of “sharing,” require that businesses enter into contracts with all entities to which they disclose personal information, remove the CCPA’s 30-day cure period, and establish the California Privacy Protection Agency—the US’ first dedicated privacy enforcer. Despite never having been reviewed by California’s legislature, the CPRA also limits the extent to which its provisions can be amended through future legislation.