The California Superior Court ruled on June 30, 2023, that the California Privacy Protection Agency (CPPA) cannot begin enforcement of the California Privacy Rights Act of 2020 (CPRA) until March 29, 2024.
Enforcement of the regulations was otherwise slated to commence on July 1, 2023. The California Chamber of Commerce (the Chamber) filed a lawsuit against the CPPA, arguing the CPPA broke its own law when it didn’t pass regulations by July 1, 2022, and argued that businesses would not have as much time as the law allows for them to prepare. The Chamber said voters intended for there to be a year between final regulations and enforcement, and the judge agreed. However, regulations weren’t finalized until a few months ago. Twelve of the agency’s regulations were finalized on March 29, 2023. Draft regulations have not been released for the remaining three areas: automated decision-making, risk assessment, and cyber security audits. Accordingly, those regulations and enforcement of them will also likely be delayed.
However, this recent Court ruling is not a complete carveout from any enforcement by the California regulator. Businesses will still need to:
- Update and review business processes, procedures, and disclosures related to California employees, job applicants, independent contractors, and business-to-business transactions. These exemptions are still expired as of January 1, 2023, and are not affected by the Court ruling.
- The CPPA still can enforce the CCPA and the CPRA - it just cannot enforce the CPRA regulations from March 29, 2023.
©2025 Katten Muchin Rosenman LLP