Two years into compliance with the California Consumer Privacy Act of 2018 ('CCPA'), the expiration of Assembly Bill 25 An act to amend Sections 1798.130 and 1798.145 of the Civil Code, relating to consumer privacy ('AB 25') ushers in new challenges. As businesses grapple with their new compliance obligations under the California Privacy Rights Act of 2020 ('CPRA') and the expiration of AB 25, proportionality is becoming an important consideration. However, what is the test for proportionality? One possible framework comes from the 2015 amendments to the Federal Rules of Civil Procedure ('FRCP'). Scott J. Hyman and Genevieve Walser-Jolly, from Severson & Werson, compare the CCPA to the FRCP and examine the utility of that existing test.

The California Privacy Protection Agency ('CPPA') released, on 3 November 2022, a revised version of the proposed regulations ('the Revised Proposed Regulations')¹ under the California Consumer Privacy Act of 2018 ('CCPA'). In particular, the Revised Proposed Regulations make amendments in regard to the collection and use of personal information as well as sensitive personal information, requirements surrounding opt-out preference signals and the right to opt-out of sales, and obligations of service providers and contractors. OneTrust DataGuidance breakdowns the key amendments since the Draft Proposed Regulations were released on 8 July 2022.

After years of unsuccessful attempts to enact nationwide data privacy legislation, the American Data Privacy and Protection Act ('ADPPA'), a proposed US federal online privacy bill that would regulate how organisations keep and use consumer data, is the furthest a federal privacy bill has managed to go so far. If enacted, the ADPPA would be the country's first comprehensive federal consumer privacy framework. Paul Lanois, Director at Fieldfisher, provides a brief comparison between specific provisions under the ADPPA and those under the California Consumer Protection Act of 2018 ('CCPA').

The California Consumer Privacy Act of 2018 ('CCPA') was signed into law on 28 June 2019 before entering into effect on 1 January 2020. The Final CCPA Regulations were approved on 14 August 2020, which provided further requirements and clarifications on the application of the CCPA.

The CCPA is one of the most comprehensive privacy laws in the US and has introduced significant compliance challenges for organisations. In particular, the CCPA established a new set of consumer rights, additional protections for children's data, and specific rules on the selling of personal information.

The framework provided by the current version of the CCPA is, though, set to change following the passing of the California Privacy Rights Act of 2020 ('CPRA') on 3 November 2020. The CPRA stipulates several amendments to be made to the CCPA, including new consumer rights, provisions for a state privacy authority, and further obligations relating to children's data. Although the CPRA will not become operative until 1 January 2023, many of its provisions will be applicable to personal information collected from 1 January 2022.