California Privacy Rights Act Enforcement Delayed
Client Alert | 1 min read | 07.06.23
In a June 30, 2023 decision by the Superior Court of California, County of Sacramento, the Court issued a ruling delaying agency enforcement of final regulations under the California Privacy Rights Act (CPRA) until March 2024. Calfornia Chamber of Commerce v. California Privacy Protection Act, Case No. 34-2023-80004106-CU-WM-GDS (Sacramento Superior Court, June 30, 2023).
The California Consumer Privacy Act of 2018 (CCPA) and the California Privacy Rights Act of 2020 (CPRA) provisions in the ballot initiative passed in 2020 by California voters are still in effect. However, enforcement of the final regulations implementing the CPRA, enacted on March 29, 2023 by the California Privacy Protection Agency (Agency) and which were set to go in effect on July 1, 2023, has been stayed by the California court until March 2024 (until one year after the enactment of the final CPRA regulations). Assuming the ruling is not overturned on appeal, it gives businesses another 9 months to become compliant with the final CPRA regulations. Businesses still need to remain compliant with the prior CCPA regulations in effect before the final CPRA regulations, including the CPRA provisions that were in the ballot initiative of 2020. The Agency has set a public meeting for July 14 to discuss enforcement and other topics.
Notably, on March 29, 2023, the Agency issued final regulations with respect to only 12 of the 15 areas required by Section 1798.185 of the CPRA. The Court ruled that enforcement of these regulations was delayed until March 29, 2024. Enforcement of any regulations in the remaining three areas (cybersecurity audits, risk assessments and automated decision-making technology) will begin until a year after the Agency finalizes those rules. The Court did not mandate any specific date by which the Agency must finalize these remaining regulations.
Contacts
Senior Counsel
She/Her/Hers
Insights
Client Alert | 10 min read | 03.27.25
FinCEN Axes Corporate Transparency Act’s Reporting Obligations for U.S. Companies and U.S. Persons
Since December of last year, the status of the CTA has been in a state of perpetual flux, following a dizzying series of federal court rulings and FinCEN announcements. On February 28, 2025, we reported that FinCEN paused enforcement actions for entities required to report under the CTA’s Beneficial Ownership Information Reporting Rule (BOI Rule) until FinCEN issued an interim final rule providing new guidance regarding the BOI Rule’s requirements and associated deadlines. Then, on March 2, 2025, Treasury went a step further, indicating that it would altogether cease enforcement against U.S. citizens and domestic reporting companies for violations of the BOI Rule, explaining that it would instead issue proposed rulemaking to narrow the scope of the BOI Rule to “foreign reporting companies” only and set new reporting deadlines.
Client Alert | 3 min read | 03.27.25
Client Alert | 3 min read | 03.27.25
MoCRA Under the Trump Era: A Look at FDA's Monitoring and Enforcement Two Months In
Client Alert | 4 min read | 03.27.25
