California Privacy Rights Act
10
MENTIONS
8
EPISODES
8
PODCASTS
Search complete. 10 mentions across 8 episodes found for "California Privacy Rights Act".
Oct 13, 2026
Charlie SimonGUEST
Right? You know, California moved pretty quickly, 2018, with the California Consumer Protection Act.
Charlie SimonGUEST
Um, later the CPRA followed.
Charlie SimonGUEST
That's the universe we all live in there.
Charlie SimonGUEST
Um-
Sergio MaldonadoHOST
What is a data broker? Under California law, which is what pretty much applies here, even though we talk about other jurisdictions.
Sergio MaldonadoHOST
So under the CCPA, as amended by CPRA, a data broker is a business that knowingly collects and sells the personal information of consumers with whom it does not have a direct relationship.
Sergio MaldonadoHOST
So, for example, if you're a publisher, you do have a direct relationship.
Sergio MaldonadoHOST
I see you.
Ralph O'BrienHOST
The governor, Gavin Newsom, I believe, has signed in a number of new ones over the past few weeks.
Ralph O'BrienHOST
The CCPA became the CPRA, and now you've got DROP and the cybersecurity audits we wanted to talk about today.
Ralph O'BrienHOST
So I guess from a general counsel point of view, how would you keep up, Phil?
Phil LairdGUEST
That's a good question.
12 MINS LATER
Kay RoyalHOST
There is a specific question around the cyber audits that I'm seeing a lot.
Kay RoyalHOST
And you may tell me we're completely wrong on a premise that we make.
Kay RoyalHOST
But CCPA, and by the way, just because it's been amended by the CPRA does not make it the CPRA law.
Kay RoyalHOST
It's still the CCPA.
Caitlin SarianGUEST
And then data privacy happened, so we had, like, in the UK there was GDPR.
Caitlin SarianGUEST
In the US there's, um, CCPA, or now it's CPRA.
Caitlin SarianGUEST
But it's, like, all these privacy laws that help people protect their privacy-
Mary Holland NaderHOST
Mm-hmm
Debbie ReynoldsHOST
Or how are you seeing that play out in your business?
Julian GageGUEST
Yeah, I mean, it's definitely applicable to a lot of the companies that we work with who don't only have to comply with, say, the GDPR, but also the CPRA and many of the US state laws.
Julian GageGUEST
So the impact is high from a what they have to comply with perspective, but operationally it's not that high and it's not that much work.
Julian GageGUEST
In reality, the way that we sort of tend to pr- propose things, and the reason for that is every time there's a new regulation, a new state, in my experience, most of the things are not actually inherently that different than what's my clients already are, are having as part of their risk framework, where they've agreed to that they're gonna be doing internally across the board, which are baked in from different international and local regulations, right? And so there are st- stipulations and, and differences, and that's when we will raise those things, and that's a big job in and of itself, right? Tracking all that stuff and assessing what's gonna apply to what, what company in terms of scope.
Julian GageGUEST
You know, so I would say the, the impact is certainly there, but I think as privacy professionals, I find that we tend to oftentimes, you know, c- uh, perhaps get overwhelmed with, overwhelmed with all these changes.
Julian GageGUEST
But, uh, but, but, but I think if you just take a s- take a breath, take a step back and see what's actually changed, in my opinion, I, I don't think it's been that, that much of an impact to companies, um, because they would, they would've already had CPRA, CPRA for many years, or they would've already had if they're a global company and GDPR requirements that, that many of them probably applied across the board instead of taking a jurisdictional approach to controls and how they comply with different products and, and, and, and yeah.
Julian GageGUEST
And yeah.
Debbie ReynoldsHOST
Yeah, yeah.
Ross SaundersGUEST
Um, there are a lot of laws out there, and I think like 20 in the last year, and there's been a uptake on how many there are.
Ross SaundersGUEST
California kind of is the leader in the pack with CCPA, CPRA, and their amendments and things like that.
Ross SaundersGUEST
And as much as there are a lot of different laws in the US, there's a lot of overlap across them.
Ross SaundersGUEST
So even like if we look at things like GDPR and PIPEDA and Law 25 here in Canada, there is a good 70, 75% overlap in a lot of ways.
HopeHOST
Several platforms have even been required by EU data protection authorities to pause AI training on EU user data, while disputes got sorted out.
HopeHOST
The second is the CCPA, sometimes called the CPRA, which covers California only.
HopeHOST
Under California's privacy law, enforced by the state's Attorney General, and the California Privacy Protection Agency, residents have the right to know what personal information a business collects, the right to delete it, and the right to opt out of its sale or sharing.
HopeHOST
And California has kept expanding this framework, especially around automated systems.
Felipe EscobarHOST
For commercial messages, follow the CAN-SPAM Act and distinguish transactional versus marketing sends in your systems.
Felipe EscobarHOST
Protect data with encryption in transit and at rest, role-based access controls, retention policies, and region-aware controls to meet GDPR, CPRA, HIPAA, or PCI DSS requirements where applicable.
Jan SantafedeHOST
How is artificial intelligence changing email triage and agent workflows?
Felipe EscobarHOST
AI brings intent classification, sentiment analysis, entity extraction, language detection, and priority scoring to speed routing.