• Permits consumers to: (1) prevent businesses from sharing personal information; (2) correct inaccurate personal information; and (3) limit businesses’ use of “sensitive personal information”—including precise geolocation; race; ethnicity; religion; genetic data; private communications; sexual orientation; and specified health information.
• Establishes California Privacy Protection Agency to additionally enforce and implement consumer privacy laws and impose fines.
• Changes criteria for which businesses must comply with laws.
• Prohibits businesses’ retention of personal information for longer than reasonably necessary.
• Triples maximum penalties for violations concerning consumers under age 16.
• Authorizes civil penalties for theft of consumer login information, as specified.

SUMMARY OF LEGISLATIVE ANALYST'S ESTIMATE OF NET STATE AND LOCAL GOVERNMENT FISCAL IMPACT:

• Increased state costs of at least $10 million annually for a new state agency to oversee and enforce consumer privacy laws.
• Increased state costs, not likely to exceed the low millions of dollars annually, for increased court and Department of Justice enforcement workload. Some or all of these costs would be paid by penalties collected for violations of consumer privacy laws.
• Unknown impact on state and local tax revenues due to economic effects resulting from new requirements on businesses to protect consumer data.

---