CALIFORNIA PRIVACY RIGHTS ACT (CPRA), IS YOUR BRAND PREPARED?

by Adam Ortman, SVP Growth & Innovation, Generator Media + Analytics

The California Privacy Rights Act (CPRA) is a new privacy law that went into effect on January 1, 2023, that affects businesses that collect and process the personal information of California residents. While the law is aimed at protecting the privacy of individuals, it also has significant implications for marketing, particularly for businesses that rely on data-driven marketing strategies. Here are some of the key ways that the CPRA affects marketing and how brands can navigate the new rules.

1. Limited data collection and use: The CPRA expands the definition of personal information and places new limitations on how businesses can collect and use it. Businesses will need to be more transparent about the types of data they collect, and they will need to obtain explicit consent from California residents before collecting certain sensitive information, such as precise location data or biometric data. This can make it more difficult for businesses to build detailed customer profiles, which is often a key element of data-driven marketing.

2. Opt-out rights for consumers: One of the key provisions of the CPRA is the right for California residents to opt-out of the sale of their personal information. Businesses will be required to provide a clear and conspicuous link on their websites that says “Do Not Sell My Personal Information” and must make it easy for consumers to exercise this right. This means that brands will need to be more careful about the data they collect and how they use it in order to avoid losing the ability to sell data to third parties.

3. Compliance obligation and penalties: Businesses must take active steps to update policies and processes to comply with the new rights and expanded definition of personal information. Businesses found in non-compliance with CPRA can face civil penalties, including fines of up to $7500 per violation and penalties of up to $7,500 per consumer per incident of noncompliance. This can be very costly for businesses that have been found in violation of the law.

4. Impact on targeted advertising: The CPRA’s provisions on data collection and consumer opt-out rights will likely have a major impact on targeted advertising. Businesses will need to be more careful about the data they collect, and they will need to obtain explicit consent from California residents before using that data for targeted advertising. Brands may need to look for other ways to reach their target audiences, such as through contextual or interest-based advertising that does not rely on personal information.

The CPRA is a significant new law that will impact how businesses operate in California, and it poses some significant challenges for brands that rely on data-driven marketing strategies. However, with careful planning and a commitment to compliance, businesses can continue to reach and engage with their target audiences while protecting the privacy of California residents.