California consumers have new rights:

- Refuse the sale or sharing of their data, with mandatory opt-in for sensitive information.
- Request corrections or deletion of their data, with businesses responsible for notifying third parties.
- Inquire about data retention durations and the criteria for these periods.
- Decline the use of automated decision-making and profiling by businesses.

As a business, you have new obligations:

- Display a privacy notice about personal information collection.
- Facilitate user rights through Data Subject Access Requests (DSARs).
- Minimize data collection and restrict usage purposes.
- Implement risk assessments and adhere to cybersecurity standards.

Financial and reputational risks for a business:

- Intentional violations: Fines up to $7,500 per impacted user.
- Unintentional violations: Fines up to $2,500 per impacted user.
- No more 30-day cure period under CPRA, unlike CCPA.
- Risk of reputation damage and customer loss. 40% of consumers would switch brands after a negative privacy experience*

* source: Google/IPSOS

CPRA - MARKETING

Impact on media performance

As a business, your ability to run remarketing audiences depends on users agreeing to your CPRA privacy notices and staying opted in to processing their personal data.

If users opt out, you cannot track conversions, resulting in lower in-platform performance and fewer data points for AI optimization.

If you are a site publisher, you won't be able to maximize advertising revenue if users opt out.