The law will replace the California Consumer Privacy Act, which was passed in 2018, following a separate push to get a privacy measure on the ballot that year. The author and chief financial backer of Proposition 24, real estate mogul Alastair Mactaggart, was behind CCPA's passage as well.
"With tonight's historic passage of Prop 24, the California Privacy Rights Act, we are at the beginning of a journey that will profoundly shape the fabric of our society by redefining who is in control of our most personal information and putting consumers back in charge of their own data," Mactaggart said in a statement Wednesday.
Earlier this year, Mactaggart told Protocol that he wanted to take a new privacy initiative, then called the California Privacy Rights Act, to the ballot because he had watched business groups attempt to undermine CCPA through changes in the legislature. "At some point it feels like when you let your guard down, one of these changes is going to come through, have a massive impact, and end up gutting the law," Mactaggart said at the time.
He undertook months of negotiations with privacy groups and business leaders, including tech giants like Facebook, Google and Microsoft in hopes of coming up with a measure that both advocacy and industry groups could live with. But Prop. 24 ended up splitting the privacy community, with organizations like Consumer Reports coming out in favor of the measure and the ACLU coming out against it. The tech community notably didn't fight the measure the way they did when Mactaggart was first pushing a privacy initiative in 2018.
The new law will preserve much of CCPA, but it will also allow Californians to require companies to limit the use of their sensitive personal information, create a new agency to handle privacy law enforcement and establish new fines for violations of children's privacy rights, among other things. Groups like the ACLU worry that the complex nature of Prop. 24 will introduce new loopholes for businesses that further expose Americans' data or require them to pay for data protection.
Businesses operating in California now have until January of 2023 to comply with the new law before it goes into effect.