Since the fourth edition of this Field Guide went to print in 2019, privacy
laws have changed, particularly in the United States. The California
Consumer Privacy Act (CCPA) took effect in 2020 and was cemented and
significantly expanded in the same year by the California Privacy Rights
Act (CPRA), which establishes the first dedicated data protection authority
in the United States and adopts many of the same types of omnibus
restrictions on personal data processing contained in the EU General
Data Protection Regulation (GDPR). The California Legislature cannot
easily amend the CCPA anymore, because the CPRA was enacted by way
of a ballot initiative by voters at the general election, limiting legislative
discretion. The California Legislature can and should, however, adjust or
repeal its myriad existing sector-, situation- and harm-specific privacy
laws, given that many of these laws are now obsolete or superseded by
the CCPA.