The California Privacy Rights Act (CPRA), also known as Prop 24, is a new privacy law that has gone into effect on January 1, 2023, and is expected to impact the digital advertising industry significantly. As a privacy professional, it is crucial to understand the changes brought about by this law and how to maintain compliance with the new regulations. To achieve this, clearly understanding data subject requests and data mapping, in general, is essential.

One of the fundamental changes introduced by CPRA is the distinction between data "sales" and "sharing." The law requires businesses to obtain explicit consumer consent before selling their personal information. The requirement for consent highlights the importance of data privacy, which protects personal information from unauthorized access or use.

Another important aspect of CPRA is the requirement for businesses to honor California's policy expectations for opt-out preference signals like the Global Privacy Control (GPC). This means that businesses must respect consumers' privacy preferences and allow them to opt out of selling their personal information. The adoption of opt-out preference signals like the GPC is likely to increase in response to the new law, giving consumers more control over their personal information and privacy preferences.

CPRA also requires businesses to obtain explicit consumer consent before collecting and using their personal information, which is similar to the European Union's General Data Protection Regulation (GDPR) requirements. This highlights the importance of data mapping, which is understanding what personal information a business collects, how it is used, and with whom it is shared. Data mapping can help businesses ensure that they are only collecting the minimum amount of personal information necessary to provide their services and appropriately securing and disposing of any information they collect.

To effectively manage the challenges posed by CPRA, privacy professionals can turn to data privacy platforms that offer consent management, data subject request fulfillment, and data mapping capabilities. These platforms can help businesses obtain explicit consumer consent, respond to subject data requests in a timely manner and maintain a clear understanding of the personal information they collect, use, and share.

The California Privacy Rights Act (CPRA) has a major impact on the digital advertising industry. Privacy professionals must understand the new privacy rights, increased focus on consumer privacy, and new state agencies to enforce privacy regulations. By using data privacy platforms that offer data mapping, consent management, and data subject request fulfillment capabilities, privacy professionals can effectively manage the challenges posed by CPRA and ensure compliance while maintaining the trust of their customers.