Proposition 24, the California Privacy Rights Act, officially passed Wednesday, with 56% of more than 11.3 million voters supporting the measure.
The ballot initiative, backed by the advocacy group Californians for Consumer Privacy, builds on the existing California Consumer Privacy Act in several ways, including by creating a new agency dedicated to data privacy and providing consumers with substantial new data control mechanisms that companies now need to implement before Jan. 1, 2023.
In a statement Wednesday morning, Californians for Consumer Privacy praised the passage of Prop 24 by a "decisive majority" of Californians, saying the measure not only grants state residents "the strongest online privacy rights in the world" but is also poised to "set the bar for privacy rights" as other states and federal lawmakers move to enact similar protections.
"With [the] historic passage of Prop 24, the California Privacy Rights Act, we are at the beginning of a journey that will profoundly shape the fabric of our society by redefining who is in control of our most personal information and putting consumers back in charge of their own data," said Alastair Mactaggart, chair of Californians for Consumer Privacy and Prop 24 sponsor. "I'm looking forward to the work ahead and the next steps in implementing this law, including setting up a commission that is dedicated to protecting consumers online."
Mactaggart, a real estate developer turned activist who proposed a similar ballot initiative in 2018 that spurred the enactment of the CCPA, first floated the proposed ballot initiative in September 2019. He's argued the enhancements are necessary to deliver privacy protections to Californians that are on par with the European Union's General Data Protection Regulation and that can't be weakened by state lawmakers who may be influenced by businesses to loosen restrictions.
The CPRA, which can only be updated with amendments that strengthen consumer privacy, hands consumers the right to limit the use and disclosure of a new category of "sensitive" personal information, which includes health, financial, racial and precise geolocation data, and to opt out of both the sale and sharing of their data. The initiative also allows consumers to correct inaccurate data, triples fines for the unlawful collection or sale of children's personal information and establishes the California Privacy Protection Agency, which is poised to replace the state's attorney general as the primary enforcer of the law.
The measure received backing from a slew of prominent groups and officials, including Consumer Watchdog, the California Black Chamber of Commerce, the president of the California NAACP and California Senate Majority Leader Robert M. Hertzberg, a Democrat who co-authored the CCPA.
Dozens of groups, including the American Civil Liberties Union of California, the California Small Business Association, the California Republican Party, the Consumer Federation of California and Color of Change, had opposed the 52-page ballot measure, arguing it would weaken the CCPA, create a "toothless new state privacy bureaucracy" and cost California consumers and small businesses billions.
In a statement Wednesday, the leaders of the opposition campaign said they were proud to have "whittled down" the lead built by the measure's backers from the 70 points indicated by a July poll to only 12 points on the morning after Election Day.
"We knew running against a real estate developer's fortune and a biased ballot label was going to be difficult," campaign chairperson Mary Ross and campaign strategist Marva Diaz said. "This coalition achieved a remarkable 58-point swing on Prop 24 in just three short months with less than $21,000 in contributions, which may be a record for California ballot measures. In a less cluttered year with relatively equal funds, the result may have been different."
The organizers added that, while they had come up short, they were encouraged that "millions of California voters still realized now is not the time to pass a measure riddled with serious flaws that creates a costly new privacy bureaucracy" and vowed to "continue the fight."
The approval of the CPRA means companies that gather data from California residents will need to revisit their privacy compliance frameworks less than a year after the CCPA — the nation's first comprehensive consumer privacy law — took effect Jan. 1.
"There's going to be a lot of layers of complexity for businesses to peel back and consider, and there will be a lot that the new regulator will need to clarify in new rulemaking," said Alan Friel, a California-based partner at BakerHostetler.
Friel said the measure presents "positives and negatives" for both consumers and businesses.
Consumers will get a new right of correction, more control over their sensitive personal information and automated decision-making and more limits on use and retention of their personal information. Companies, meanwhile, will likely appreciate the extension by another two years of the current reprieve on the application of these obligations to personal information generated within the employment, human resources and business-to-business contexts, Friel said.
However, companies will also soon need to contend with a newly created dedicated privacy regulator, which Friel said is likely to be the "biggest impact" of the CPRA, and refine their procedures to allow consumers to exercise their new rights to correction and to opt out of the sharing of personal data, including for targeted advertising.
"The CPRA wades into the confusion CCPA has created for digital advertising, but it only partially answers questions vexing industry," Friel said, adding that the measure leaves up in the air whether publishers or ad tech companies are responsible for offering the opt-out to consumers.
Tom Foulkes, senior director of state advocacy at trade group BSA: The Software Alliance, called the passage of Prop 24 "another important step in the critical and growing discussion about finding the right set of protections for consumers and obligations on businesses."
"We are certain other states, and the new Congress, will have more to say on this in 2021," Foulkes said. "We look forward to working with legislators in the coming months to get this right for consumers and businesses."
--Editing by Orlando Lorenzo and Marygrace Murphy.
For a reprint of this article, please contact reprints@law360.com.
