Back in July, we shared some good news out of California when a state court judge ruled that the newest regulations under the California Consumer Privacy Act (“CCPA”) could not be enforced until March 2024.  But last week, the agency charged with enforcing the CCPA – the California Privacy Protection Agency (with the confusingly similar abbreviation of the “CPPA”) – won reversal of that opinion on appeal.  The ruling now gives the CPPA the authority to begin enforcing immediately the regulations that it enacted in March 2023.

Despite this outcome, the lawsuit by the California Chamber of Commerce certainly bought businesses more time – the CPPA was poised to begin enforcement of the regulations on July 1, 2023, before the lower court delayed enforcement.  Given the March 2024 date established by last summer’s opinion, impacted companies were hopefully already moving toward compliance in the areas covered by the regulations at issue.  These regulations cover topics like privacy notice requirements and handling of browser opt-out signals, among other issues.  But importantly, the regulations do not cover all topics for which additional regulations are required under the statute, and the CPPA continues to evaluate more proposed regulations. 

The issue before the California appellate court was whether the CPPA was required to delay the enforcement of its new regulations because the agency missed (by many months) the July 1, 2022 deadline for regulations established by statute.  The court held that “because there is no ‘explicit and forceful language’ mandating that the agency is prohibited from enforcing the act until (at least) one year after the agency approves final regulations, the trial court erred in concluding otherwise.”  This ruling, if it stands, would mean that the CPPA could immediately enforce other regulations when enacted.

If your company has been waiting to evaluate its privacy obligations, now is the time to act.  Companies should consult with counsel to determine whether the law applies to them, whether the regulations will impact their business, and how to ensure prompt compliance.

[View source.]