Businesses Face Compliance Challenges as Lawmakers Hobble to Finalize CPRA Regulations

Californian lawmaker The California Privacy Protection Agency updated the California Privacy Rights Act (CPRA) regulations earlier this week. This, however, is not the final draft despite the law going into effect on Jan. 1, 2023. The agency said it would hold more public hearings later this week to discuss the proposed regulations, including modifications, before providing businesses with a final draft. Although the timeline for the final draft remains unclear, with two months left until the law goes into effect, businesses will face challenges in complying with the letter of the law in time, according to privacy and data security lawyer at Davis and Gilbert, Gary Kibel. “We're in this weird situation," he said. "The law takes effect in 10 weeks, and we don't have final regulations yet." Biden Signs New Data Transfer Framework to Save U.S.-EU Data Flow California has some of the strictest state-wide user privacy laws in the U.S. CPRA is essentially an amendment to the preexisting California Consumer Privacy Act, containing similar provisions to Europe's General Data Protection Regulation. Although lawmakers are hustling to meet to finalize the final draft, the revised amendments appear clearer than the originals, sources said. But it will take companies additional steps to comply, privacy experts told Adweek. Here are some of the high-level takeaways under the updated rulebook: The agency deleted numerous requirements to simplify the regulations. Businesses are no longer required to identify which third parties collect personal information on their websites. This means companies can still work with numerous faceless ad-tech vendors, which privacy advocates have previously dissuaded against. While businesses are required to recognize opt-out preference signals, they are no longer mandated to provide notifications to the user if they recognize these requests, including the requests to limit the use of sensitive personal information. For example, if someone shopping on Sephora's site chooses to opt-out of signals, they won't be prompted with notices stating that Sephora has recognized their opt-out preferences. According to the updated CPRA, a data analytics provider, under certain cases, can be classed as a service provider and not a third party. That's not to say that the clauses are less stringent for service providers, who under contract with the entity can only collect information for business purposes and not for selling or sharing that data. Google Analytics has been in the crosshairs for being classed as a third party (rather than a service provider). As a result, the company has restricted its data processing under CCPA, which by default restricted how it uses personal information. "A lot of people in the privacy community have fought that [Google Analytics] is a service provider relationship, not a third-party sale relationship," said David Stauss, partner at law firm Husch Blackwell. This lack of clarity gained attention after the Sephora settlement. The loose definitions in the initial regulations were read to understand that data analytics businesses are third-party providers, which would classify the data transfer as a sale of data under CCPA, which, under the law, needs user consent. Although the agency made an attempt to make things easier for businesses, it made it tricky for businesses to align with a consumer’s reasonable expectations. But, aligning with peoples' reasonable expectations is “sometimes hard and is subjective,” Kibel said. For example, consider an ad-supported business that offers a digital service to users for free. The consumer may expect to get good service for free, whereas the business would expect to monetize the consumer’s data in exchange for their free service. Key Dates to Note for Upcoming State Privacy Laws “Lining up those expectations can be challenging,” Kibel added. Although the CPRA cannot be enforced until July 1 next year, businesses are required to comply with CCPA in the interim, said Stauss. “A difficulty that companies are faced with right now is that when the law goes into effect, it substantially changes requirements and rights," he said. "But since CPRA can't be enforced until July, it leaves companies in a difficult position of knowing how exactly to drive compliance."