In a recent decision, a California court blocked the California Privacy Protection Agency (CPPA) from enforcing its recently promulgated regulations. The court’s decision, announced on June 30, 2023, stems from the mandate outlined in the California Consumer Privacy Act, which requires the CPPA to establish final regulations by July 1, 2022, and commence enforcement on July 1, 2023. However, due to delays, the final rules were only unveiled on March 29, 2023, leaving a brief window between the regulatory issuance and the intended enforcement date.

As a result of the ruling, the CPPA is now prohibited from enforcing the regulations until March 29, 2024. Among other things, these regulations prohibit the use of “dark patterns,” require businesses to recognize opt-out preference signals, and mandate that businesses provide a notice at the point of collection. This decision grants businesses additional time to review the finalized regulations and proactively address any gaps within their compliance programs. Additionally, it signals that future CPPA regulations are likely to be subject to a one-year implementation period, providing businesses sufficient time to implement new requirements.

While the enforcement of the regulations has been temporarily postponed, it is important to note that the CPPA remains committed to enforcing the California Consumer Privacy Act (as amended by the California Privacy Rights Act), which took effect on January 1, 2023. In light of the court’s decision, the CPPA reaffirmed its dedication to upholding this law and is actively bolstering its staff to ensure robust oversight.

Businesses should take full advantage of this additional time to carefully review the finalized regulations, identify any compliance gaps and proactively address them. In so doing, businesses can ensure a smooth transition and position themselves well for when the (potentially robust) enforcement period begins in 2024.