The Superior Court of California, County of Sacramento recently issued an order delaying the enforcement of newly enacted California Privacy Rights Act (CPRA) regulations until March 29, 2024, one year from the date they were finalized.

Does this really make a huge difference for a company’s CPRA compliance efforts? Not really.

Here is why:

1) The "new bits" of the CPRA Regulations weren't going to be "hard-enforced" immediately anyway.

Ashkan Soltani, executive director of the California Privacy Protection Agency (CPPA), had already said that for these particular aspects of the regulations his agency’s focus will be on educating “the public and businesses on their rights and responsibilities.”

“We hope to drive voluntary compliance given we are still in the process of building out our enforcement team,” he has said.

2) The CPRA itself is fully enforceable, as is the previous tranche of the regs

Big things, like transparency, consumer requests, do not sell, etc., are already in effect and are fair game for enforcement.

3) The CPPA views the new regs as a clarification of the existing obligations, and not as creating anything new. Enforcement, therefore, will reflect that.

In its final statement of reasons for the regulations, the CPPA made it clear that it does not perceive the regulations to be an added burden. The agency stressed the regs were a "necessity" (used 135 times) to "clarify" what is already there (used 89 times) and that many changes were "non substantial" (used 34 times), "consistent with" the provisions of the law (used 29 times) or were there to "provide guidance" to businesses (used 16 times).

In addition, the CPPA estimates that costs of compliance with the revised regs is only $42.50, with zero ongoing costs. That is because companies were already supposed to have been doing most of these things to comply with the law itself.

[View source.]