Business Law Journal

Businesses had been preparing for the imminent enforcement of the regulations, and the delay gives welcome relief and more time to properly evaluate the regulations, which deal with important issues such as consumer opt-out mechanisms, handling consumer requests under the statute, and data processing agreements.

The decision came in a case brought by the California Chamber of Commerce after the CPPA admitted that it would not meet the statutorily mandated deadline for finalizing the regulations (and, indeed, the first of at least two sets of regulations was only just barely finalized in late March 2023).  The Chamber had sought to delay enforcement of the entire CPRA until twelve months after all regulations were completed.  The Sacramento County Superior Court declined to go quite that far, and refused to delay enforcement of the statute itself, but the Court granted the Chamber’s request for an injunction and delayed enforcement of the regulations until March 29, 2024.  Additionally, the Court ruled that any future regulations will also not be enforced until one-year from the date of enactment.

What the Ruling Means for Businesses

Businesses subject to the CCPA[1] as amended by the CPRA will now have an additional nine months to comply with the March 29, 2023 CPRA regulations.  However, because the Court refused to delay enforcement of the statute itself, businesses still must comply with the CPRA itself, which made several important changes to the CCPA.  (AALRR previously covered how businesses can prepare for the CPRA in a three part blog series which can be found here, here, and here).  

For example, the Court’s decision did not affect the expiration of exemptions for employee, job applicant and business-to-business data, which are now subject to the law.  Accordingly, if you have not already done so, your business needs to update its privacy notices and policies to address the new requirements.  

The Court’s ruling does, however, mean that businesses should prioritize ensuring compliance with currently enforceable statutory requirements.  Businesses should focus now on meeting the current requirements and developing a strategy for understanding the regulations and taking advantage of the delay to become fully compliant with the complex regulations.  

AALRR is ready and able to help with this process and or any questions you may have.  Please contact the authors of this article or your trusted adviser at AALRR to discuss next steps or questions. 

[1] Is My Business a Covered Business Subject to the CCPA/CPRA? A covered business is one that (1) conducts business in California for the profit or financial benefit of their shareholders or owners, (2) collects consumers’ (i.e., California residents) personal information, and (3) that meets any of the following three thresholds:

• Has annual gross revenues in excess of $25 Million; or
• Annually buys, receives, sells, or shares for commercial purposes the personal information of 100,000 or more consumers, households, or devices; or
• Derives 50% or more of its annual revenues from selling or sharing consumers’ personal information.

Covered businesses also include companies and individuals that control or are controlled by a business that satisfies the above requirements and have common branding (e.g., name, service mark, trademark, etc.) with a business that satisfies the above requirements.

This AALRR post is intended for informational purposes only and should not be relied upon in reaching a conclusion in a particular area of law. Applicability of the legal principles discussed may differ substantially in individual situations. Receipt of this or any other AALRR publication does not create an attorney-client relationship. AALRR is not responsible for inadvertent errors that may occur in the publishing process. 

© 2023 Atkinson, Andelson, Loya, Ruud & Romo