This act builds on the California Consumer Privacy Act (CCPA).
Some of the developments include:
- Expanded definition of personal information
- Partial exemption for employee data
- Clarification on financial incentives
- Mandatory "Do Not Sell My Personal Information" link
- Registration requirement for data brokers
- Private right of action for consumers
- 45-day period for business response starts upon receiving a verifiable request
- Exclusion of de-identified or aggregate information