AB21

AB21 refers to a proposed legislation in California that was introduced in 2021, officially titled the "California Privacy Rights and Enforcement Act" (CPRA) amendments. The bill, authored by Assemblymember Buffy Wicks, aimed to strengthen the California Consumer Privacy Act (CCPA), which was enacted in 2018. The CCPA was one of the first state-level laws in the U.S. to give consumers greater control over their personal data collected by businesses.

The primary focus of AB21 was to address gaps and ambiguities in the CCPA by expanding consumer rights, particularly around the use of sensitive personal information. Sensitive data, as defined by the bill, includes information such as social security numbers, driver’s license numbers, genetic data, precise geolocation data, and personal data categories revealing religious or philosophical beliefs, mental or physical health, sexual orientation, or citizenship status.

Under AB21, businesses would have been required to obtain explicit consent from consumers before collecting, using, or sharing sensitive personal information. The bill also introduced stricter obligations for businesses to disclose their data collection practices and provide consumers with the ability to opt out of the sale or sharing of their personal data. Additionally, AB21 proposed creating a new enforcement authority within the California Attorney General’s office specifically dedicated to overseeing compliance with the CPRA.

AB21 faced significant opposition from industry groups, including tech companies and trade associations, which argued that the bill imposed heavy compliance burdens without sufficient consumer benefits. After extensive debate, the bill ultimately failed to pass during the 2021 legislative session. The CPRA, which was approved by voters in November 2020, remains the primary framework governing consumer privacy in California, with ongoing discussions and potential future amendments.