Despite this outcome, the lawsuit by the California Chamber of Commerce certainly bought businesses more time – the CPPA was poised to begin enforcement of the regulations on July 1, 2023, before the lower court delayed enforcement. Given the March 2024 date established by last summer’s opinion, impacted companies were hopefully already moving toward compliance in the areas covered by the regulations at issue. These regulations cover topics like privacy notice requirements and handling of browser opt-out signals, among other issues. But importantly, the regulations do not cover all topics for which additional regulations are required under the statute, and the CPPA continues to evaluate more proposed regulations.
The issue before the California appellate court was whether the CPPA was required to delay the enforcement of its new regulations because the agency missed (by many months) the July 1, 2022 deadline for regulations established by statute. The court held that “because there is no ‘explicit and forceful language’ mandating that the agency is prohibited from enforcing the act until (at least) one year after the agency approves final regulations, the trial court erred in concluding otherwise.” This ruling, if it stands, would mean that the CPPA could immediately enforce other regulations when enacted.
If your company has been waiting to evaluate its privacy obligations, now is the time to act. Companies should consult with counsel to determine whether the law applies to them, whether the regulations will impact their business, and how to ensure prompt compliance.