Enforcement Date for CPRA Regulations Delayed Until March 2024 by California Court

The California Superior Court in Sacramento has ruled that the regulations promulgated by the California Privacy Protection Agency (“CPPA”) under the amended California Consumer Privacy Act (“CCPA”—the amended act the “CPRA”) will not be enforceable on July 1, 2023. The new enforcement date will be March 29, 2024—one year from the date the regulations were finalized by the Agency.

On June 29, 2023, the court issued a tentative ruling holding that the initiative to amend the CCPA, which indicated regulations should be finalized by July 1, 2022 and effective July 1, 2023, meant voters intended for businesses to have a twelve month period to come into compliance with such regulations. The CPPA did not finalize its regulations until March 29^th of this year. The California Chamber of Commerce (“the Chamber”) filed suit, arguing regulations should not be enforceable until 12 months after promulgation of all the required regulations set forth in the CPRA. Note that the CPPA has not issued regulations in several areas set forth in the statute yet, which means, if the Chamber were to prevail, enforcement of any regulations would not be permissible until 12 months after the CPPA completes all of its required rulemakings.

Today’s adoption of the tentative ruling partially agreed with the Chamber’s position. The court held that the CPPA cannot enforce promulgated regulations until 12 months after they are finalized.  But the court declined to extend the enforcement date until 12 months following the issuance of all statutorily required regulations. Thus, under this Order (assuming the CPPA does not appeal and prevail), enforcement of regulations issued by the CPPA may only begin twelve months after promulgation. Those issued this spring cannot be enforced until March 29, 2024.

While enforcement of the regulations are delayed until March 29, 2024, it is important to remember that the CPRA amendments to the CCPA statute are still enforceable beginning July 1, 2023. Colorado and Connecticut’s privacy laws also still go into effect on July 1, 2023.