The California Privacy Rights Act (CRPA) was enacted in 2020 and won't technically be enforced until 2023. However, it contains a one-year look-back window, meaning that the law will apply to data you collect in 2022. While dire warnings about the AdTech industry seem to be given every week at least, this is one law you'll want to pay attention to- and you may regret it next year if you don't.

Richy Glassberg, CEO of SafeGuard Privacy, authored a great run-down of CPRA's implications for businesses that share and sell data in an AdExchanger article last month. The key takeaway: the data your organization collects will be subject to CPRA data restrictions in 2023. If you're not compliant with the law, you may end up needing to relinquishing data collected in 2022, which would put any non-compliant organization at a significant disadvantage heading into 2023. That can't be an acceptable situation for any data-driven organization.

What do I need to do to be CPRA compliant?

So, what are the key aspects that you need to be compliant with CRPA? Here are a few recommendations:

1. Disclose your data usage to users and make sure to include specific use cases for their data. Without these user-facing changes, your data will be non-compliant heading into 2023.
2. Enter into data usage contracts with your third-parties, and ensure that those partners are also CPRA compliant.
3. Enhance your understanding and scrutiny of "Sensitive Personal Information" and ensure that data is CPRA-compliant.

Here are a few resources that will help you prepare for CPRA:

• Mark Your Calendars: Compliance With CPRA Begins New Year’s Day 2022
• New Rules for Behavioral Advertising: How the CDPA and CPRA Compare
• California Privacy Rights Act Passes: Five Tips to Help Companies Prepare for California’s New, New Thing!
• CPRA Law Text

First-Party tracking can help.

MetaRouter can help you prepare not only for CRPA, but all impending customer data privacy laws- allowing for flexible and transparent data control and management. By replacing third-party tracking with first-party tracking and making deliberate, explicitly-defined data mappings, you'll prepare for a future where data regulations such as CPRA will be ubiquitous across the globe.