In the midst of the chaos of the COVID-19 pandemic, the California Attorney General announced on Friday that the final California Consumer Privacy Act (CCPA) regulations have been approved and are now in effect.  The process that began in late 2019 (with some interesting twists – remember this:) has finally come to an end and now companies will at least know the text of the regulations they must follow.  CCPA enforcement began on July 1, 2020 but such enforcement, until Friday, was limited to only the raw text of the statute.  We should expect new enforcement actions to be focused on the CCPA regulations going forward.

The regulations are not a mere restatement of the statute.  They contain many new obligations on companies for CCPA compliance.  For example, the statute requires a business to respond to requests to know and requests to delete within 45 calendar days.  However, the regulations now impose a requirement that a business  confirm receipt of such requests within 10 business days.  Thus, a company with individual rights processes built around the 45 day statutory timeline without a request acknowledgement at a sooner time built in may now be out of compliance with the CCPA.

Any company that is subject to the CCPA should act quickly to ensure compliance in light of these finalized regulations.  The final text of the regulations can be found here.