In 2023, a California superior court halted enforcement of any final California Privacy Protection Agency regulation implemented until a period of 12 months from the date that individual regulations became final. Based on the ruling, enforcement of the initial regulations passed in March 2023 could not commence until March 2024.
The California Privacy Protection Agency (CPPA) appealed the decision and on February 9, 2024, the California Court of Appeal reversed the superior court. With the reversal, the regulations enacted last year are now deemed active in advance of March.
The ruling also enables the CPPA to immediately begin enforcing other future regulations as soon as they are finalized, rather than having to wait a year as previously ruled by the superior court.
The regulations passed in March 2023 were intended to:
- Update existing regulations to fit with amendments made by the California Privacy Rights Act (CPRA).
- To put into operation new rights and concepts introduced by the CPRA
- Make the regulations more streamlined and easier to understand.
The revised regulations include regulations on data processing agreements, consumer opt-out mechanisms, mandatory requirements for recognition of opt-out preference signals, and consumer request handling.
Jackson Lewis will continue to track information related to privacy regulations and related issues. For additional information on the CPRA, please reach out to a member of our Privacy, Data, and Cybersecurity practice group.