# Untangling How the California Privacy Rights Act Impacts Digital Advertising

## 5 Things to Know: CPRA, Cookies, and Consent

**Introduction**  
Proposition 24, the California Privacy Rights Act (CPRA), significantly expands and strengthens the California Consumer Privacy Act (CCPA). The CPRA gives Californians new rights and creates additional obligations forcing businesses to carefully review their online advertising practices. Rulemaking by the California Privacy Protection Agency (“Agency”) reinforces the sweeping scope of California’s opt-out requirements as highlighted by the California attorney general’s settlement with cosmetics giant.

As of Jan. 1, 2023, businesses must give Californians a clear opt-out option when asking to “share” their data with adtech companies and related analytics providers, with few legal exceptions. Despite California and the European Union’s shared goal of giving consumers a genuine choice about online profiling and tracking, their requirements are very different. This report covers the relationship between data “sales” and “sharing” under the amended CCPA, discusses California’s policy expectations for opt-out preference signals like GPC, and unpacks how this affects European-style cookie compliance approaches.

## Compliance Timeline

### When do I need to comply with CPRA?
You must comply with the CCPA as amended by CPRA as of Jan. 1, 2023. The CPRA is a set of voter-led amendments and doesn’t create a new law separate from the CCPA. In November 2020, California voters approved Proposition 24, the CPRA, which amended the CCPA to include additional privacy protections beginning on Jan. 1, 2023. The CPRA/Prop 24 also expanded and strengthened California’s regulatory regime. For more information please see the Agency’s FAQs.

## Data Sharing and Sales

CPRA amendments clarify the concept of data “sharing” by explicitly stating that many cases of personal data “sharing” count as a sale. This clarification closed a CCPA loophole that allowed some adtech companies to continue monetizing consumer data as long as money wasn’t explicitly exchanged in a data “sale.”

### Key Definitions
1. **All “shares” are “sales,” but not all “sales” are “shares”**  
   What counts as a data “sale”?  
   “Data sales” refer to the practice of disclosing personal information to third parties for “monetary or other valuable consideration.” This type of data sale is generally considered to be a way for companies to monetize customers’ offline and/or online personal information. This includes exchanges for free or discounted services and data-enhanced services like those offered by adtech and related analytics providers.  
   “Data sharing” refers to the practice of disclosing personal information to third parties for cross-context behavioral advertising (CCBA) irrespective of monetary or other valuable considerations. CCBA providers track a user's behavior across different websites, platforms, and devices to deliver more relevant and personalized ads based on the user’s online activities.

CPRA “sharing” intentionally overlaps with CCPA “sales.” CPRA gives consumers the right to opt out of the monetization of their data. The CCPA’s definition of monetization includes behavioral advertising with inherent benefits – valuable considerations – for the companies involved. This means if personal data is shared for contextual advertising, it counts as a sale.

### Legal Interpretations
CA attorney general confirms behavioral advertising involves “sales.” “Many online retailers allow third-party companies to install tracking software on their website and in their app so that third parties can monitor consumers as they shop… Retailers like Sephora benefit in kind from these arrangements, which allow them to more effectively target potential customers. Sephora's arrangement with these companies constituted a sale of consumer information under the CCPA, and it triggered certain basic obligations...”

Document loading complete. You are on page 1.