On the eve of the California Privacy Protection Agency’s (CPPA), the California Chamber of Commerce’s lawsuit obtained a significant victory as the Sacramento County Court granted an injunction against the CPPA delaying enforcement of its new regulations for one year from the March 29, 2023 effective date as applied to twelve of fifteen areas of regulation. In addition, as the other three areas subject to regulations have not been finalized, any enforcement actions must be delayed for one year after they become final. The Court recognized the difficulties that businesses would have coming to terms with newly published regulations on such a short time frame in light of the statutory intent to provide a twelve-month window. On July 14, 2023, the CPPA will hold a closed session to receive legal counsel guidance as to the CalChamber case, and could appeal that order. 

In March, the CPPA announced that the new regulations interpreting the California Privacy Rights Act (CPRA) would be enforced starting on July 1, 2023.  

However, employers and businesses subject to the CPRA must remember that the CPRA’s statutory mandate and previous regulations remain enforceable by the State of California and through a private right of action. Indeed, even before the CPRA regulations were published enforcement actions out of Sacramento continued. Therefore, businesses should ensure that they are either in compliance or getting into compliance with the structures of the CPRA with guidance from the CPPA’s final regulations that were issued in March 2023 as the new enforcement day will come sooner rather than later.