California Privacy Rights Act & What It Means for Consumers

In 2020, voters approved the California Privacy Rights Act (CPRA), a measure designed to strengthen the earlier California Consumer Privacy Act (CCPA). Californians can demand transparency about how their information is collected and hold businesses legally accountable when their personal details are mishandled.

Expanded Rights Under the CPRA

The CPRA introduced new rights and broadened those already available under the CCPA. Californians can now:

• Request access to their data: Consumers have the ability to see what data is being collected, how it is used, and whether it is shared or sold.
• Delete personal data: Individuals can request removal of their information, with a few exceptions for necessary business uses.
• Correct errors: If a company keeps inaccurate or outdated records, consumers may ask for corrections.
• Limit use of sensitive information: A new category called “sensitive personal information” includes data such as race, religion, precise location, health details, and financial account information. Consumers may restrict how businesses process or share this information.
• Opt out of sales or sharing: Companies must give clear options—often via a “Do Not Sell or Share My Personal Information” link—to allow consumers to block data transfers to advertisers or partners.
• Protect minors’ data: If businesses exploit the data of children and teenagers, they face steeper penalties.

Why the CPRA Matters to You

Before California passed these laws, many companies quietly collected and sold consumer data without consent or transparency. The CPRA shifts power back into the hands of consumers.

If you discover that a retail app is selling your purchase history to advertisers, you can demand they stop. And if you don’t want businesses tracking your location every time you use a service, you can restrict that use.

Why Work With The Lyon Firm

The CPRA imposes complex obligations on businesses, and many attempt to limit compliance. Consumers benefit from having experienced legal representation when companies refuse to honor requests or when their data is exposed.

The Lyon Firm has represented individuals in privacy and consumer protection cases across the country. We investigate data misuse and hold corporations accountable when they put profits ahead of consumer rights.

Frequently Asked Questions About the California Privacy Rights Act (CPRA)

What is the difference between the CCPA and the CPRA?
The California Privacy Rights Act (CPRA) builds on the California Consumer Privacy Act (CCPA). While the CCPA granted basic consumer rights like access and deletion, the CPRA strengthens those rights, adds new protections for sensitive personal information, and establishes the California Privacy Protection Agency (CPPA) to enforce compliance.

When did the CPRA go into effect?
The CPRA went into effect on January 1, 2023, and applies to data collected from January 1, 2022 onward. Enforcement began in July 2023 through the CPPA and the California Attorney General.

What counts as “sensitive personal information” under the CPRA?
The CPRA defines “sensitive personal information” broadly. It includes:

• Precise geolocation data
• Race, ethnicity, religion, or union membership
• Genetic, biometric, or health data
• Sexual orientation information
• Private communications such as emails or text messages

Can consumers sue companies directly under the CPRA?
The CPRA expands the private right of action first introduced in the CCPA. Consumers may sue if their personal information is exposed due to inadequate security practices, including cases where login credentials are stolen in a data breach.

What are the penalties for violating the CPRA?
Businesses may face fines of $2,500 per violation, or $7,500 per intentional violation or violations involving minors. Importantly, these fines can add up quickly in class action cases or large-scale breaches.