UPDATE: CCPA Regulations Enforcement Delayed (but employers should take action now)

On June 29, 2023, the Sacramento County Superior Court issued a tentative ruling (upheld during oral argument) staying the California Privacy Protection Agency (CPPA or the Agency) from enforcing the California Consumer Privacy Act of 2018 (CCPA) Regulations until one year after the final enactment of any individual regulation.

To provide some needed context, the California Office of Administrative Law approved the first final rulemaking package proposed by the Agency, otherwise known as the CCPA Regulations, on March 29, 2023. The Regulations were intended to provide added clarity to the CCPA’s substantive requirements and harmonize the CCPA with the changes adopted through Proposition 24 and California Privacy Rights Act.

The Superior Court’s ruling on June 29, 2023, provides that the Agency’s enforcement of any of the final regulations will be stayed for a period of 12 months from the date that the individual regulation becomes final. This means that the final regulations which were published on March 29, 2023, cannot be enforced by the Agency until March 29, 2024.

Important Distinction Between the Final Regulations and the CCPA
The stay however does not purport to apply the California Attorney General’s ability to enforce the CCPA’s statutory provisions, who has in fact began ramping up enforcement actions and notices of violations. Of note, the Attorney General recently secured a $1.2 Million settlement with Sephora, Inc. which resolved allegations that the Company violated the CCPA. More recently the Attorney General announced an investigative sweep, specifically targeting mobile applications.

Businesses should be aware that the Attorney General’s enforcement efforts are expected to continue during this time as it relates to the Act itself.

Takeaways for Businesses
While businesses now have additional time to familiarize themselves with the Final Regulations, the statutory provisions of the CCPA remain enforceable during this time. It is an important reminder to businesses that the Regulations were to operate as technical clarifications to the CCPA’s substantive requirements and therefore businesses should not delay in taking all appropriate steps in ensuring compliance with the CCPA.

Rather businesses can now use the Regulations to better understand their obligations under the CCPA, prepare for enforcement of the regulations in 2024, undertake additional trainings and strive toward improving its compliances processes.