California became the first state in the nation to grant its citizens new and enhanced privacy rights when it enacted the California Consumer Privacy Act of 2018 ("CCPA").1 Since its passage, the California legislature has amended the CCPA;2 California voters modified the CCPA when they passed ballot proposition 24, the California Privacy Rights Act of 2020 ("CPRA");3 the California attorney general implemented final regulations;4 and the California Department of Justice began enforcing the CCPA.5 The CCPA has also been the subject of litigation. This survey reviews further CCPA developments during the past year and the enactment of similar consumer privacy laws in Virginia and Colorado.


The CCPA defined a "consumer"6 so broadly that it included employees, contractors, and job applicants. To limit the reach of the CCPA, the legislature amended the act to exempt employee and employment-related information through January 1, 2022.7 The CPRA extends this deadline through January 1, 2023.8

Most of the bills introduced in the 2020-21 legislative session that sought to amend the CCPA failed to advance, or dealt with medical-related issues.9

However, one bill authorized consumers whose non-encrypted and non-redacted personal information was subject to a data breach to institute a civil action.10 This bill provides further incentive for businesses to protect their data and to encrypt consumers' personal information.

To read the full article, please click here.


1. CAL. CIV. CODE §§ 1798.100-1798.199 (West 2021). See generally Sanford Shatz & Susan E. Chylik, The California Consumer Privacy Act of 2018: A Sea Change in the Protection of California Consumers' Personal Information, 75 BUS. LAW. 1917 (2020) (in the 2020 Annual Survey).

2. See Sanford P. Shatz & Paul J. Lysobey, The California Consumer Privacy Act of 2018 Updated: More Protection in the Quest to Access and Protect Personal Information, 76 BUS. LAW. 685, 686 (2021) (in the 2021 Annual Survey).

3. See id. at 691-92.

4. See id. at 687-90.

5. See id. at 690.

6. CAL. CIV. CODE § 1798.140(g).

7. Id. § 1798.145(h).

8.  CAL. CIV. CODE § 1798.145(m).

9. See, e.g., A.B. 1436, 2020-21 Reg. Sess. (Cal. 2021) (digital health feedback systems); A.B. 814, 2020-21 Reg. Sess. (Cal. 2021) (contact tracing); S.B. 41, 2020-21 Reg. Sess. (Cal. 2021) (genetic testing).

10. See, e.g., A.B. 1391, 2020-21 Reg. Sess. (Cal. 2021) (unlawfully obtained data systems).

Originally published by The Business Lawyer.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.