California AG Initiates CCPA Investigations, Despite Setback in Court

California Attorney General Rob Bonta (California AG) recently announced that his office issued several inquiry letters to large California employers requesting information about their compliance with the California Consumer Privacy Act (CCPA). These letters reveal two key takeaways for businesses subject to California’s privacy law: (1) the California AG plans to press forward with CCPA enforcement, notwithstanding the State’s recent loss in state court with respect to enforcement of the newest CCPA regulations; and (2) the California AG is honing in on the privacy practices of California employers.

First, even though a California state court granted covered businesses some relief in a recent ruling, businesses cannot not sleep on their obligations under California privacy law. Specifically, on June 30—one day before California’s newest CCPA regulations were set to become enforceable—a California Superior Court ruled that the State may not enforce any regulations issued under the California Privacy Rights Act (CPRA) until one year after such regulation was promulgated.[1] For the newest CCPA regulations, the ruling means that the “[California Privacy Protection] Agency may begin enforcing th[e] regulations that became final on March 29 [of this year] on March 29, 2024.” The ruling was a loss for the State, and gives businesses more runway to contend with and implement complex new rules promulgated pursuant to the CPRA.  

However, the ruling does not mean that there will be no CCPA enforcement activity until next year. Specifically, the ruling only delays enforcement for new regulations promulgated pursuant to the CPRA, not existing CCPA regulations or the CPRA’s statutory requirements. The California AG’s recent announcement makes this point clear, as his office is moving ahead with enforcement, notwithstanding the setback with respect to the new rules.

Second, with respect to the substance of the California AG’s announcement, this latest enforcement sweeps deals with California employers’ data practices under the CCPA. Prior enforcement activity brought by the California AG pursuant to the CCPA includes the settlement with Sephora resolving allegations that the company failed to disclose to consumers that it was selling their personal information and failed to process opt-out requests via user-enabled global privacy controls in violation of the CCPA, as well as several other investigative sweeps, most recently of popular mobile applications compliance with consumer opt-out requests. Companies subject to the CCPA should pay close attention to this announcement—as well as past enforcements—as these activities highlight the California AG’s priorities and can provide insights into the State’s interpretation of this complex law.   

***

Wiley’s Privacy, Cyber & Data Governance Team and State Privacy Laws Team have helped companies of all types respond to federal and state investigations into their data and consumer practices. Please contact Kat Scott (kscott@wiley.law), Joan Stewart (jstewart@wiley.law), Tyler Bridegan (tbridegan@wiley.law), or Boyd Garriott (bgarriott@wiley.law) if your organization needs assistance in understanding, complying with, or responding to inquiries related to California’s privacy laws.

[1] This decision is still pending a final order.