Kevin Patariu, James Snell, and Marina Gatto were quoted in the OneTrust DataGuidance article titled "California: CPRA Approval a Sign That "California Has Always Been a Leader in Innovation"" regarding the changes that Proposition 24 brings forth to the current CCPA.

Kevin told OneTrust DataGuidance, "The CPRA amends Section 1798.140(j) of the California Civil Code to add a new definition of 'contractor' as 'a person to whom the business makes available a consumer’s personal information for a business purpose pursuant to a written contract with the business' with specific contractual obligations to prevent the contractor from a) selling or sharing personal information; b) retaining, using, or disclosing personal information outside of the scope of the contract or direct business relationship between the contractor and business; and c) combining the personal information received under the contract with personal information from other sources, with limited exceptions. The contract must also permit the business to monitor the contractor's compliance and include a certification that the contractor understands its obligations."

Addressing the impact of this addition on consumer rights, Marina stated, "The CPRA extends the rights that were previously granted to consumers under the CCPA by the inclusion of the term 'sharing.' This has implications such as extending a business's 'sale'-related obligations to also apply to the 'sharing' of personal information, and limiting a business's ability to share a consumer's personal information beyond that which is 'reasonably necessary and proportionate to achieve the purposes for which the personal information was collected or processed, or for another disclosed purpose that is compatible with the context in which the personal information was collected, and not further processed in a manner that is incompatible with those purposes."

James told OneTrust DataGuidance, "The most significant impact of the new state privacy agency is the establishment of a new process for enforcement of the CPRA and CCPA through the administrative procedures act rather than the state courts. This will require privacy lawyers to become familiar with the administrative procedures act and the procedures for claims, defences and discovery."