While California remains under state and local Safer-at-Home orders, and many businesses have been shuttered or forced to modify their day-to-day business, the California Attorney General still intends to begin to enforce California’s Consumer Privacy Act (“CCPA”) on July 1, 2020.  Several industry groups and businesses have complained that the hardship placed on businesses in recent months, along with the fact that there are no current implementing regulations for the CCPA, should result in a delay in enforcement.  So far, the California Attorney General’s office has not been receptive to these arguments.

Currently, the CCPA, which applies to any company that does business with California residents, must disclose the categories of data that it collects and provides to third parties, and must also provide the ability for consumers to opt-out of having their data collected and sold. ^[1] While the CCPA went into effect on January 1, 2020, the state Attorney General said it would not begin to enforce the law until six months after the CCPA’s implementing regulations were adopted, or July 1, 2020, whichever date comes first.

Currently, the CCPA’s implementing regulations are in the comment period on their third draft.  If the current draft regulations are adopted before May 31, 2020, they will become effective July 1, 2020.  However, if the current draft regulations are not adopted, and there is a fourth draft, there will be no implementing regulations by the July 1, 2020 enforcement date, leaving open the possibility that the California Attorney General will begin enforcing the regulations without implementing regulations.  That situation would seem to be untenable, so either the current implementing regulations will be adopted and effective July 1, 2020, or the enforcement date may need to be moved.

Businesses must assume, however, that the law will begin to be enforced on July 1, 2020.  Depending on the data collected, developing a comprehensive CCPA compliance program can be a time consuming process.  Any business that has not evaluated what it needs to do to comply with the CCPA should do so immediately.

[1] For greater detail on the requirements of the CCPA (without the benefit of the final implementing regulations) please see Proposed Regulations and Recent Amendments Clarify Compliance with the California Consumer Privacy Act as Effective Date Looms