On June 1, 2020, California Attorney General Xavier Becerra submitted a finalized package of CCPA regulations to the California Office of Administrative Law (OAL).   The package included not only the final text of the regulations, but also the final statement of reasons for amendments to the previous drafts. There have been multiple rounds of drafts of the regulations, along with corresponding comment periods and workshops.  The first comment period received over 1,700 comments, leading to modifications published on February 7, 2020.  A second set of modifications released on March 11, 2020 eliminated the opt-out button and clarified procedures for consumer requests.  This finalized version of the regulations appears nearly identical to the March version.

Attorney General Becerra has stood firm in his insistence on the scheduled enforcement deadline of July 1, 2020, notwithstanding pleas to delay enforcement due to the COVID-19 pandemic.  However, the regulations must first be approved by the OAL, which has 90 days to make its decision.  Specifically, the OAL has 30 working days, plus an additional 60 calendar days under Executive Order N-40-20 related to the COVID-19 pandemic, to review the package for procedural compliance. However, the AG submitted a written justification for a request for an expedited review by the OAL to be completed within 30 business days and that the Final Regulations become effective upon filing with the Secretary of State.  Notably, the statute has been in effect as of January 1, 2020, and the statute includes a 12-month “look-back” requirement allowing consumers to request their records dating back one year from when the request was made.

While these CCPA regulations move toward finalization, we have previously written about a new ballot initiative scheduled for November 2020 for the California Privacy Rights Act (CPRA), commonly referred to as CCPA 2.0, which would significant strengthen the CCPA’s requirements and enforcement tools, would weaken defenses to private rights of action under the CCPA, and would establish the California Privacy Protection Agency to enforce privacy rights in California.

To view the final CCPA regulations, click here.

To view the California Attorney General’s press release, click here.

To view the California Attorney General’s supporting documentation, click here.