The California Consumer Privacy Act (CCPA) that went into effect on January 1, 2020 provided for a grace period to allow companies additional time to come into compliance with the new regulation. That grace period ensured the California Attorney General’s office would not bring enforcement actions until six months after publication of the office’s regulations, or July 1, 2020, whichever came first. The AG’s office continues to revise its proposed regulations, including revisions as recent as March 11, 2020, so the grace period is still currently scheduled to end July 1, 2020.

In light of the new circumstances caused by the global coronavirus pandemic, dozens in the business community have urged California’s attorney general to delay any enforcement of the CCPA, arguing that the pandemic has complicated and inhibited these organizations’ efforts to implement changes and meet the Act’s obligations, which continue to shift as the AG’s office issues ongoing regulatory changes. This chorus urging delay includes the California Chamber of Commerce, the Advanced Medical Technology Association, and UPS. They are asking that the enforcement deadline be postponed to January 2, 2021.

While the coalition advocates for a delay—noting that such a deferral would help to relieve the new additional pressures caused by responding to COVID-19 and “would better enable business leaders to make responsible decisions that prioritize the needs and health of their workforce over other matters”—there is no sign yet that the Attorney General’s office is inclined to delay enforcement. Indeed, it may now be even more important that businesses are mindful of data security during this pandemic. According to reports, the AG’s office has indicated that it has no plans to delay the enforcement deadline, and calling out “the new reality created by COVID-19 and the heightened value of protecting consumers’ privacy online that comes with it.” Moreover, it indicated it might begin earlier than July 1. But given that the statute allows earlier enforcement only if such time occurs six months after publication of the final regulations (which have yet to be published), it is difficult to see how it could lawfully do so.

We will be watching for any formal response from the AG’s office on this matter. In the meantime, best practice would suggest that businesses continue to act as though AG enforcement will go into effect July 1, 2020, while balancing the new demands the ever-changing coronavirus situation is placing on them.