The California Privacy Protection Agency’s (“Agency”) ability to enforce its regulations has been a hot topic over the last year and the most recent twist puts the Agency back into the enforcement business immediately.

California’s voters enacted the California Privacy Rights Act (the “Act”) in 2020 which called for regulations to be issued and that businesses would have time to adapt to the regulations with enforcement of regulations by July 1, 2023. However, the Agency took a long time to adopt regulations, doing so on March 29, 2023—just a few months before enforcement was set to take place. At that point, the California Chamber of Commerce swiftly and successfully enjoined the Agency from enforcing its regulations for another year—arguing that business had one year to get into compliance with the new regulations. The Agency filed a petition for extraordinary writ relief, and on February 9, 2024, the Third District Court of Appeal restored the Agency’s ability to enforce these new regulations.

The main issue on appeal was whether a one-year waiting period between final regulations and enforcement was mandated by the CPRA. The California Chamber of Commerce argued that a one-year gap between adoption and enforcement was required. The Court of Appeal sided with the Agency, finding no requirement for a one-year gap between adoption of the regulations and enforcement.

While the Agency’s ability to enforce regulations is now restored, the California Chamber of Commerce’s quick thinking and legal talent to obtain the injunction allowed covered employers almost a full year to prepare for compliance with the revised regulations.

Thus, the revised regulations, adopted in March 2023, are now in effect and the Agency may begin enforcement immediately. All covered employers must ensure that they are in compliance with these new regulations.

CDF’s Privacy Practice Group will continue to monitor developments related to the CCPA, the CPRA and the Agency’s enforcement actions.