CPRA Update: California Court Delays Enforcement of New Privacy Regulations

UPDATE: A California Appeals Court has reversed the decision delaying enforcement of the CPRA regulations. Read more here.

On Friday, June 30, 2023, a California state superior court ruled that any California Privacy Rights Act (CPRA) regulation may not be enforced until one year after the regulation is promulgated. Practically speaking, this means that the recently adopted CPRA rules may not be enforced until March 29, 2024, and any additional CPRA rules that are adopted in the future may not be enforced for a period of 12 months after they become final.

The ruling’s reasoning stems from the structure of the CPRA and the California Privacy Protection Agency’s (Agency) delay in promulgating regulations. The CPRA provides that the Agency must adopt implementing regulations by “July 1, 2022” and that enforcement of those regulations “shall not commence until July 1, 2023.” But the Agency did not finalize its first set of regulations until March 29, 2023, and it has still not adopted some regulations. Despite missing its July 2022 deadline, the Agency represented that it would begin enforcing its recently enacted regulations on July 1, 2023, and could potentially enforce future regulations as soon as they are promulgated.

But, in the June 30 decision, the California Superior Court for the County of Sacramento determined that this course of action was unlawful. The court explained that the July 2022 promulgation deadline and July 2023 enforcement deadline established that California voters intended to establish a 12-month gap between promulgation and enforcement. Thus, the court explained, the regulations may not be enforced on July 1, 2023. Rather, enforcement must wait for the statutorily required 12 months and begin no sooner than March 29, 2024. For future regulations, there must also be a 12-month wait after regulations are finalized before initiating enforcement.

While this is good news for businesses that have been working to implement obligations from the new regulatory requirements, this does not mean that businesses can take their foot off the pedal in implementing a compliance plan for ever-increasing privacy obligations. The June 30 decision only delays enforcement for new CPRA regulations, not existing California Consumer Privacy Act (CCPA) regulations or the CPRA’s statutory requirements. Further, new laws in Colorado and Connecticut still took effect July 1, 2023.

***

Wiley has a deep and experienced bench of attorneys specializing in privacy compliance – please contact any of the authors on this alert to discuss your privacy needs.