Companies that have been wrestling with exactly how to comply with the latest regulations under the California Consumer Privacy Act (CCPA) can breathe a sigh of relief after a California state court judge ruled last week that the newest regulations cannot be enforced until March 2024.  If you’re familiar with the changes to the CCPA, you know that regulators were supposed to have the accompanying regulations in place by July 2022, but failed to do so – in fact, the regulations were not final until March 29, 2023, nearly three months after the statutory effective date of January 1, 2023.  The California Privacy Protection Agency (CPPA) voluntarily extended the enforcement deadline to July 1, 2023, but even then, many companies were left scrambling until last Friday, when Judge James Arguelles of the Superior Court of California in Sacramento County entered an injunction barring enforcement of the regulations until March 2024.

The ruling is the result of a lawsuit by the California Chamber of Commerce against the CPPA, asking the Court to order the CPPA to promulgate final regulations on all topics (notably, the March 29 regulations are incomplete) and delay enforcement until a year after all regulations are finalized.  Judge Arguelles found that the CPPA cannot enforce the new regulations until March 29, 2024, one year after the new regulations are final, but the order does not delay enforcement until a year after a complete set of regulations are prepared. 

Importantly, however, the Court’s order does not prevent the CPPA from enforcing the language of the statute itself, which went into effect on January 1, 2023, nor does it prevent private plaintiffs from using the CCPA’s private right of action to bring civil claims.  Thus, while companies now have a reprieve from interpreting the CPPA’s regulations, they need to ensure that they are complying with the statutory requirements.

Whether your business has been CCPA compliant for years and you just need some help getting up to speed on the latest regulations, or you have no idea what the confusingly similar CCPA, CPRA, and CPPA acronyms mean, our team is available to help you improve your privacy posture.