The California Superior Court just delivered some good news to businesses in California, giving them some additional time to get in compliance with the final California Privacy Rights Act (CPRA) provisions – which were scheduled to go into effect on July 1, 2023 but now have an effective date of March 29, 2024.

As a reminder, the CPRA is a new data privacy law that amends and expands upon the California Consumer Privacy Act (CCPA) and also establishes the California Privacy Protection Agency (CPPA), as responsible for enforcing and implementing the CPRA. It aims to strengthen privacy protections for California residents and enhance their control over their personal information.

And just recently, the Superior Court upheld a tentative order enjoining the California Privacy Protection Agency from enforcing the final CPRA regulations until 12 months after its enactment.

Backing up on how we got here — in March 2023, the California Chamber of Commerce (the Chamber) filed a suit against the CPPA, arguing that California voters “intended for the Agency to issue the complete regulations covering the fifteen mandatory issues by July 1, 2022,” and that “…the voters intended businesses to have one year from the Agency’s adoption of final regulations before the Agency could begin enforcement.” The Chamber further argued that businesses would be unfairly prejudiced by the California CPPA’s enforcement of the Act beginning on July 1, 2023 because of the fact that the CPPA finalized the regulations on March 29, 2023 — a delay of eight months beyond the timeframe specified for issuing those regulations.

The Superior Court’s ruling acknowledged the need for businesses to have adequate time to prepare for enforcement but was not entirely aligned with the Chamber’s arguments enforcement cannot begin until all the regulations were finalized. While the Superior Court agreed with the intent of a 12-month stay, it clarified that enforcement can begin 12 months after any regulation that has been finalized. This means that once the regulations are properly promulgated, enforcement can commence 12 months after their promulgation – and does not need to be delayed until after all the regulations are finalized.

For the regulations that were finalized and adopted on March 29, 2023, enforcement can only begin on March 29, 2024, as per the court’s order. As for the yet-to-be-finalized regulations covering cybersecurity audits, risk assessments, and AI, their enforcement will have to wait until 12 months after their finalization.

While there is now another 9 months to get fully compliant with the CPRA requirements, it is crucial to note that that CCPA vests the California Attorney General’s office with enforcement and the 12 month stay does not apply to the AG’s ability to enforce key CCPA statutory requirements– such as the CCPA’s do not sell requirements, CCPA’s requirement to honor consumer deletion of information requests and other consumer requests, and right to know.

So, in light of the postponed deadline, we strongly advise California bussiness to exercise caution and maintain their ongoing efforts towards CCPA/CPRA compliance.

And let’s not forget that the Colorado Privacy Act and Connecticut Personal Data Privacy and Online Monitoring Act still went into effect on July 1, 2023. The evolving landscape of state consumer data privacy laws necessitate a proactive and comprehensive approach to compliance — and it all starts with keeping track of the new State Privacy Laws page on TCPAWorld.com!