CPRA amendments to California's privacy law take effect

The California Privacy Rights Act (CPRA) amendments to the California Consumer Privacy Act (CCPA) took full effect on January 1, 2023, representing the most significant expansion of consumer privacy rights in the United States since the original CCPA became enforceable in 2020. The CPRA, passed by California voters as Proposition 24 in November 2020, introduced sweeping new rights and obligations, including the right to opt out of the 'sharing' of personal data — a term deliberately crafted to capture cross-context behavioral advertising even when no monetary exchange occurs. This closed a major loophole in the original CCPA, which only addressed the 'sale' of data and which many ad tech companies had argued did not apply to their data-sharing practices. The CPRA also established the California Privacy Protection Agency (CPPA), a first-of-its-kind dedicated state privacy enforcement body with rulemaking and enforcement authority, reducing reliance on the California Attorney General. New consumer rights introduced or expanded under the CPRA include the right to correct inaccurate personal information, the right to limit use of sensitive personal information (such as precise geolocation, race, and health data), and stronger data minimization requirements. Businesses subject to the law — generally those with annual gross revenues over $25 million, handling data of 100,000 or more consumers, or deriving 50% or more of revenue from selling or sharing personal information — faced significant compliance obligations including updated privacy notices, opt-out mechanisms, and contractual requirements with data partners. The effective date of January 1, 2023 marked a watershed moment for the AdTech industry, as the explicit inclusion of 'sharing for cross-context behavioral advertising' directly targeted the programmatic advertising ecosystem's core data flows. The law required businesses to honor Global Privacy Control (GPC) signals as a valid opt-out mechanism, putting technical pressure on publishers, ad servers, consent management platforms, and DSPs to update their infrastructure accordingly.

The CPRA's enforcement created immediate and lasting pressure across the entire AdTech supply chain. Publishers operating in California were required to implement compliant opt-out mechanisms — including honoring GPC browser signals — and update data processing agreements with their ad tech vendors. Demand-side platforms, data management platforms, and data brokers faced heightened scrutiny over their data sourcing and audience segmentation practices, as the expanded definition of 'sharing' made it far harder to argue that behavioral targeting data flows fell outside the law's scope. This accelerated industry investment in privacy-preserving technologies, first-party data strategies, and contextual advertising solutions as alternatives to third-party cookie-based targeting. The CPRA also intensified the competitive divide between large platforms and smaller ad tech players. Walled gardens such as Google, Meta, and Amazon — which already operated largely within first-party data environments — were better positioned to absorb compliance costs and adapt their targeting products. Smaller independent ad tech companies, data brokers, and identity resolution vendors faced disproportionate compliance burdens and increased legal exposure. The law's sensitive data provisions particularly impacted health, financial, and location-based advertising segments, prompting many advertisers to reassess their data strategies in these verticals. Beyond California, the CPRA served as a de facto national standard given California's economic size and the impracticality for most businesses of maintaining separate data practices by state. It accelerated the broader 'privacy by design' movement in AdTech and contributed to growing industry momentum around alternative identity solutions, clean rooms, and cohort-based targeting. The establishment of the CPPA as a dedicated enforcement agency signaled that privacy enforcement would become more systematic and technically sophisticated, raising the stakes for non-compliance across the ecosystem.