California Privacy Rights Act (CPRA)
The California Privacy Rights Act (CPRA), effective January 2023, expanded California's CCPA with enhanced consumer privacy rights — including expanded opt-out rights, sensitive personal information protections, and the California Privacy Protection Agency for enforcement — significantly affecting B2B marketing data practices.
Why This Matters
CPRA strengthens California's privacy regime beyond CCPA's 2018 baseline. Key expansions: explicit opt-out from sale/sharing of personal information (broader than CCPA's sale-only opt-out), sensitive personal information designations with additional protections, employee data coverage (CCPA had limited employee data coverage), and the California Privacy Protection Agency (CPPA) as dedicated enforcement body. B2B operations must update privacy practices: provide clear opt-out mechanisms, honor 'Do Not Sell or Share' preferences, document data processing activities, and respond to consumer rights requests within mandated timeframes. CPRA compliance has driven significant updates to B2B marketing operations.
Frequently Asked Questions
Frequently Asked Questions
Does CPRA apply to B2B marketing?
Yes for businesses meeting CCPA/CPRA thresholds (annual revenue >$25M, processing data of 100K+ California residents, or 50%+ revenue from selling personal information). B2B marketing data on California residents is subject to CPRA requirements including consumer rights, opt-out mechanisms, and data processing disclosures.
What CPRA changes most affected B2B marketing?
Expanded opt-out rights (covering 'sharing' of data not just 'selling'), sensitive personal information protections, employee data coverage, and dedicated CPPA enforcement authority. Most B2B operations updated privacy policies, opt-out workflows, and data processing documentation in response to CPRA.