In our previous GA4 blog, we briefly mentioned new security features being implemented to focus on improving data security. Now, we want to give a more detailed overview of these consumer rights that all businesses should be aware of.

Google Analytics 4 will be implementing more security features that align with regulations such as the (soon-to-be) CPRA and the GDPR. These regulations protect the consumer’s privacy, which may restrict a business’s or organization's ability to collect and process personal data. This week, we’ll introduce you to the CPRA.

Currently the California Consumer Privacy Act of 2018 (CCPA) is a state-wide data privacy bill meant to give [California resident] consumers control over their personal information. Taking effect on January 1, 2023, is the California Privacy Rights Act of 2020 (CPRA) which is an amendment of CCPA. This amendment has amplified consumer privacy and protection of consumer rights. Here is what you can expect starting in 2023 according to what we know. 

This law applies to

• for-profit companies that facilitate business in California with the following requirements;

• gross annual revenue of over $25 million in the preceding calendar year

• buy, sell, or share personal information of 100,000 or more California consumers or households

• derive 50% or more of their annual revenue from selling or sharing California residents’ personal information

Two new business categories

• a joint venture or partnership of businesses where each business has at least 40% interest and each business within the joint venture is considered as a separate business

• any business that does not fall under the given qualifications can voluntarily certify to the CPPA that it is in compliance with CPRA

Consumer Rights

CPRA has expanded and added to the rights originally provided in the CCPA. Below is the full list of CPRA consumer rights:

• right to delete personal information

• right to correct inaccurate personal information

• right to know what personal information is being collected

• right to know what personal information is sold and to whom

• right to opt-out of sale or sharing of personal information

• right to limit use of sensitive personal information

• right to exercise CPRA rights

Receiving Consent

Along with consumer rights comes receiving consent to collect and process consumer data. CPRA clearly states the definition of consent. Consent means any freely given, specific, informed, and unambiguous indication of the consumer’s intention.

Penalties

Should you violate these regulations, there are penalties involved. In the event of a violation, a business could face a cease and desist violation, be subject to an administrative fine of up to $2,500 for each violation, or up to $7,500 for each violation involving a minor. 

Moving Forward

So how should you prepare for CPRA? Here’s what we recommend:

• determine if CPRA applies to your business

• update contracts with service providers, contractors, or third parties if needed

• add “Do Not Share” opt-out notification

• update privacy policy

• include consumer request forms due to expanded consumers rights to request information 

Stay tuned next week for Part 2, when we’ll explore further into GDPR.

PK Information is a FileMaker-certified development agency serving the Tampa Bay and Knoxville regions. We believe that great software can change everything. Would your database benefit from a process review? Contact us today!