California enacted the California Consumer Privacy Act (CCPA) in 2018, which was the first of its kind in the U.S. and drew inspiration from Europe’s General Data Protection Regulation (GDPR). Following California’s lead, other states, including Colorado, implemented their own laws and regulations. California further strengthened its legislation in 2020 through a ballot initiative known as the California Privacy Rights Act (CPRA).
Unlike the GDPR, the first generation CCPA was light on affirmative due diligence requirements and many companies designed data privacy and protection programs that were little more than window dressing (e.g., privacy policies and a consumer rights request process). In the second generation of state consumer privacy laws and regulations, as well as in recent laws pertaining to the privacy of minors (such as in California and Connecticut), numerous states require affirmative due diligence and a structured approach for conducting and documenting risk assessments and associated remediation. The assessment documentation must be available for review by regulators, and the CPRA requires risk assessments to be filed with the state, a requirement that is currently under consideration in a condensed form with certification by the executive officer. This means that companies subject to the applicable state privacy laws need to develop or refine their data inventory and assessment practices as a top priority in 2024 to be prepared for the coming enforcement of these requirements.
