Measure 71 California represents a pivotal update to the state’s data privacy and consumer rights framework. It builds directly on the foundation established by the California Consumer Privacy Act and the California Privacy Rights Act.
Supporters argue that this measure modernizes protection for sensitive personal information, while critics highlight concerns about implementation costs and regulatory complexity. Understanding its details is essential for businesses and residents alike.
| Aspect | Description | Implication | Relevant Statute or Rule |
|---|---|---|---|
| Official Title | Data Privacy and Enforcement Amendments | Reflected on ballots as Measure 71 | California Constitution and Civil Code amendments |
| Effective Date | privacy rights landscape.January 1, 2025, with certain provisions activating earlier | Section 3, Article XVI, California Constitution | |
| Scope of Covered Data | Expands covered data to include precise geolocation, biometric data, and inferred sensitive data | Higher compliance obligations for entities handling these categories | Civil Code Sections 1798.100–1798.190 |
| Enforcement Authorities | California Privacy Protection Agency plus heightened private right of action for breaches | Increased avenues for regulatory action and consumer litigation | CPPA Regulations, Civil Code 1798.150 |
| Key Obligations | DPIAs for high-risk processing, opt-out mechanisms, and data minimization mandates | New operational controls and documentation requirements | CPPA implementing regulations, Civil Code 1798.130 |
Key Definitions and Scope under Measure 71 California
What Constitutes Sensitive Personal Data
Measure 71 California significantly expands the definition of sensitive personal information to include precise geolocation within 1,750 feet, certain biometric data, and inferred data that reveals sensitive characteristics. These categories trigger enhanced safeguards and user controls.
Updates to Existing Privacy Rights
The measure updates opt-out rights for targeted advertising and cross-context behavioral advertising, strengthens the right to correct inaccurate personal information, and clarifies responsibilities related to data retention and deletion requests.
Compliance Requirements for Businesses
Data Protection Impact Assessments
Entities conducting high-risk data processing must complete documented Data Protection Impact Assessments. These assessments evaluate risks to consumer privacy and outline mitigations before processing begins.
Contractual and Vendor Management
Businesses must update contracts with service providers to reflect new obligations, including stricter data handling standards, audit rights, and requirements for subprocessor transparency under Measure 71 California rules.
Enforcement and Private Rights of Action
Regulatory Oversight by the CPPA
The California Privacy Protection Agency gains expanded rulemaking and enforcement powers, including the ability to impose penalties and require remediation plans for non-compliant organizations.
Private Lawsuits for Data Breaches
Measure 71 introduces a private right of action for certain data breaches involving sensitive personal information, allowing consumers to seek statutory damages when proper security practices are not followed.
Key Takeaways for Residents and Businesses
- Measure 71 California expands the definition of sensitive personal information and tightens obligations around its handling.
- Businesses must implement Data Protection Impact Assessments for high-risk processing activities.
- Enhanced enforcement through the CPPA and new private rights of action provide additional consumer remedies.
- Organizations must revise privacy notices and consent mechanisms to comply with updated opt-out and correction rights.
- Stakeholders should monitor CPPA rulemaking and guidance to ensure ongoing compliance with evolving requirements.
FAQ
Reader questions
Does Measure 71 California apply to small businesses
Yes, the measure applies to businesses that meet the statutory definition of “business,” including small and mid-sized companies, although certain thresholds and exemptions may limit obligations for very small entities with minimal data processing activity.
How will Measure 71 affect existing privacy policies
Organizations must update their privacy policies to reflect new rights, data categories, and disclosures required by Measure 71 California, ensuring clear communication about data use, sharing, and consumer choices.
What qualifies as precise geolocation under the new rules
Precise geolocation refers to geographic coordinates capable of identifying a device or individual within 1,750 feet, and businesses must obtain opt-out consent before processing such data for purposes beyond what is strictly necessary.
Can consumers still exercise rights under previous California privacy laws
Yes, Measure 71 California preserves existing rights under the CCPA and CPRA while adding new layers of protection, updated definitions, and expanded enforcement mechanisms that strengthen overall privacy safeguards.