Everything you Need to Know About the CPRA Rollout

    Cecilia Nzaou
    Cecilia Nzaou
    5 min read
    Posted on November 28, 2022
    Everything you Need to Know About the CPRA Rollout

    While the United States is gearing up for new state privacy regulations coming into effect in 2023 (Virginia, Colorado, Utah), the first-ever comprehensive privacy law in the country – CCPA (California Consumer Privacy Act) – has been revised to include consumer rights under what is called the CPRA (California Consumer Privacy Rights Act). 

    By now, you have heard of CPRA, but if you haven’t, here’s everything you need to know: 

    What is CPRA and how is it different from CCPA? 

    CPRA essentially works as an addendum to the CCPA. The CPRA will go into effect on January 1, 2023, and it will be enforceable starting on July 1, 2023.  

    While there are a few differences, especially with the addition of new consumer rights, the main changes revolve around the sharing of personal data and the introduction of the SPI category (Sensitive Personal Information), which includes precise geo-location.  

    Here’s a high-level deep dive:

    Business Size

    For-profit businesses that collect personal information from California residents, determines the purposes in California and meet any of the following: 

    • Have a gross annual revenue of over $25 million; 
    • Buy, receive, or sell the personal information of 50,000 or more California residents, households, or devices; or 
    • Derive 50% or more of their annual revenue from selling California residents’ personal information.

    For-profit businesses that collect personal information from California residents, determines the purposes in California and meet any of the following: 

    • Have a gross annual revenue of over $25 million; 
    • Buy, sell, or share the personal information of 100,000 or more California residents or households; or 
    • Derive 50% or more of their annual revenue from selling or sharing California residents’ personal information.
    Effective from January 1, 2020  January 1, 2023
    Consumer Rights 
    • Right to Know  
    • Right to Delete  
    • Right to Opt-out of Sale of Personal Information 
    • Right to Opt-in (for consumers under the age of 16 if applicable) 
    • Right to non-discriminatory treatment for exercising any rights 
    • Right to initiate a private cause of action for data breaches. 

    All rights under the CCPA, plus: 

    • Right to Rectification 
    • Right to Limit Use and Disclosure of Sensitive Personal Information 

    Amended right: 

    • Right to Opt-out of Sale or Disclosure of PersonaI Information
    Personal Information Definition  “Personal information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.  Personal information, as well as “Sensitive Personal Information” which includes information such as SSN, driver license numbers, biometric information, precise geolocation, and racial and ethnic origin. 
    Third Parties “Service Provider” – an entity that processes personal information on behalf of a business pursuant to a written contract.  “Contractor” – an entity ‘to whom a business makes available a consumer’s personal Information for a business purpose pursuant to a written contract with the business’ 
    • Attorney General can pursue violations 
    • Consumers have a private right of action for a breach of certain information 
    • Businesses have a 30-day cure period before being fined for a violation by the AG 
    • Creation of the California Privacy Protection Agency for enforcement and guidance 
    • Consumers have a private right of action for a breach of certain information 
    • Businesses no longer have a 30-day cure period before being fined for a violation by the CPRA
    Definition – Sell vs. Share “Sell” – for monetary or other valuable consideration

    “Sell” – for monetary or other valuable consideration 

    “Share” – share by a business to a third party for cross-context behavioural advertising for the benefit of a business where no money is exchanged

    Personal Information of Minors  Fines for violations of the personal information for minors is the same as the fines for other types of personal information – $2,500 for each unintentional and $7,500 for each intentional violation  Automatic $7,500 fine for a violation involving the personal information of minors 


    What does it mean for app developers?

    To become compliant with CPRA, app developers and publishers will need to:   

    • Inform consumers of the new CPRA rights through their privacy policy  
    • Provide a clear link to users for “Do Not Sell My Personal Information” and a link for “Limit the Use of My Sensitive Personal Information”. This can be coupled if it allows the user to opt out.  
    • Acquire consent to sell or share personal information of users younger than 16 years-old from the guardian.  
    • Given the above, rely on a mechanism to honor opt-out requests to scale and process opt-out requests.  

    How is InMobi preparing?

    We have been compliant with the CCPA since its release in January 2020, and we plan to do the same for the CPRA when it comes into effect on January 1, 2023. 

    We are making changes to our systems to consume the do_not_sell flags from our publisher customers so they can inform us when a user opts out. The same will be applicable for our mediation partners and supported header bidding solutions. This means that publishers will be able to send us an opt-out flag at the request level.  

    We will also provide a form on the InMobi Publisher Dashboard where publishers will be able to raise Data Subject Rights, including the CPRA rights.  

    In parallel, we are also expanding the scope of Data Subject Rights that we support, in line with CPRA requirements which will be reflected in our CCPA privacy addendum. 

    We will notify our customers and work with them to start adopting the API. 

    Stay Up to Date

    Register to our blog updates newsletter to receive the latest content in your inbox.