California voters will decide in November whether to expand the state's consumer privacy law with a new ballot measure. Secretary of State Alex Padilla announced that the proposal has qualified for the November 3 election.
The measure would let consumers opt out of having their personal data shared, restrict how businesses use sensitive data such as geolocation, race and health information, and create a state agency to enforce the rules.
At a glance
- The measure is on California's November 3, 2020 ballot.
- It would expand the California Consumer Protection Act (CCPA).
- It would create a dedicated state enforcement agency, budgeted at about $10 million a year.
- Penalties for violations affecting minors under 16 would triple.
- Backer Alastair Mactaggart sponsored the original 2018 law and this expansion.
Background: where the CCPA came from
California passed the CCPA in 2018 after activist Alastair Mactaggart spent millions on a ballot measure of his own. He withdrew that measure when lawmakers passed a compromise version. The CCPA went into effect on January 1, 2020.
The law gives California residents the right to ask what data a company holds on them, request deletion, and opt out of sale. Companies cannot sell data on children under 16 without opt-in consent. The new measure would tighten those rules and add the first state-level enforcement agency dedicated to consumer privacy.
Who should care
| Group | What's at stake |
|---|---|
| California residents | Tighter control over personal data, including geolocation and health information; easier opt-out mechanisms |
| Businesses operating in California | New compliance obligations, particularly around a universal opt-out signal; potential for steeper penalties |
| Privacy advocates | A dedicated enforcement agency instead of relying on an already-busy Attorney General's office |
| Industry opponents | Ballot-box laws are harder to amend later if provisions prove unworkable; no legislative safety valve |
Our analysis
The core tension here is not simply privacy versus commerce. It is enforcement capacity.
The CCPA's weakness is structural: the Attorney General's office oversees it alongside every other consumer protection duty. A dedicated agency could build specialized expertise and move faster on complaints. But it also adds a new bureaucracy and compliance burden.
Penalties for violations involving minors receive the loudest press coverage, but the universal opt-out signal is the provision that will reshape how websites work. If passed, every California-bound visitor could send one signal that companies must read and honor on every page load. Businesses that treat this as a checkbox exercise will face the sharpest enforcement risk.
Opponents make a legitimate point about flexibility. Ballot initiatives resist refinement. If a technical definition proves unworkable or a new data practice slips through the cracks, the legislature cannot patch it without another popular vote. That is a real cost for companies operating in an industry where practices evolve constantly.
What to watch next
- Whether the Internet Association and major platforms mount a visible campaign against the measure or stay quiet.
- How quickly the new agency could issue implementation guidance if the measure passes.
- Whether other states accelerate their own privacy legislation pending California's November result.
Bottom line: California set the de facto national privacy floor in 2020. This measure asks whether that floor needs shoring up—or whether it needs a new foundation.
Key takeaways
- The measure would create a dedicated California privacy enforcement agency.
- Penalties for violations involving minors under 16 would triple.
- A universal opt-out signal is the provision most likely to reshape business operations.
- Industry groups argue ballot-box privacy laws are harder to amend than statutes.
Frequently asked questions
When is the vote?
November 3, in California.
Who is behind the measure?
It is sponsored by Alastair Mactaggart, who also backed the original 2018 CCPA.
What is the biggest change for businesses?
A dedicated state enforcement agency and a requirement to honour a universal opt-out signal.
Will it apply outside California?
No. Like the original CCPA, the measure applies to California residents, but in practice most large businesses apply it nationally.