California Privacy Regulators Appeal Compliance Enforcement Delay

On August 4, the California Privacy Protection Agency (the Agency) and California Attorney General (AG) Rob Bonta filed an appeal to overturn a recent trial court decision that would result in a 12-month delay in enforcement of the updated California Consumer Privacy Act (CCPA) regulations, which were enacted following passage of the California Privacy Rights Act (CPRA). The court’s ruling stemmed from the CPPA’s failure to finalize the regulations by the July 1, 2022 deadline imposed by the CCPA. The court’s ruling stemmed from the Agency’s failure to finalize the regulations by the July 1, 2022 deadline imposed by the CCPA. However, the Agency failed to finalize regulations until nearly nine months later, on March 29, 2023. And the Agency still needs to promulgate regulations on the topics of cybersecurity audits, risk assessments, and automated decision-making.

In a press release published by the Agency, Executive Director, Ashkan Soltani, decried the trial court’s decision: “The judge’s order strips Californians of these protections and advances businesses’ interests over the rights of Californians. Our petition reflects our commitment to fight to protect the privacy of Californians and what they voted for.”

The appeal signals the CPPA and AG’s readiness to enforce the CCPA (as amended by the CPRA) and the updated regulations, but also leaves businesses to wonder, yet again, when compliance with the updated regulations will actually be enforced. To learn about other recent privacy developments, including the launch of the Agency’s Online Complaint Form, check out our recent blog posts.

Written by Maddie Level and Will Davis