Log in or register
Share on LinkedInShare on LinkedIn

ARTICLE · 13 APRIL 2023

California's OAL Finalizes CPRA Regulations

Katten
Katten
Contributor
Katten

Katten

With client service at our core and a collective desire to foster an inclusive environment for a...

View firm profile
Explore more from Katten

On March 30, 2023, the California Privacy Protection Agency (CPPA) announced that its rulemaking package to implement the California Consumer

United StatesConsumer Protection
Trisha Sircar
Trisha Sircar
Author LinkedIn connections

On March 30, 2023, the California Privacy Protection Agency (CPPA) announced that its rulemaking package to implement the California Consumer Privacy Act of 2018 (CCPA), as amended by the California Privacy Rights Act of 2020 (CPRA), was approved by the California Office of Administrative Law (OAL).

The finalized rules contain no substantive changes to the final proposed draft of the CPRA regulations released on January 31, 2023. The first CPRA rulemaking package addresses regulations concerning data processing agreements, consumer opt-out mechanisms, mandatory recognition of opt-out preference signals, dark patterns and consumer request handling. The second set of CPRA rules will address cybersecurity audits, risk assessments and automated decision-making.

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

Register for freeORLog in

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

View source

Related Articles

Legal Intelligence Newsletters: sign up for the latest legal and regulatory news on your chosen topics

Read more about

Related Comparative Guides

See more popular content from

Article

New York City’s Click-to-Cancel Rule: What Businesses Need To Know

New York City has enacted the nation's first municipal click-to-cancel rule, requiring businesses to provide clear disclosures, simple cancellation processes, and advance renewal notices for subscription services. With approximately 30 states already implementing similar regulations and the federal landscape in flux following the FTC's vacated rule, companies now face an increasingly complex patchwork of compliance obligations. The rule takes effect October 1, 2026, and imposes penalties ranging from $525 t
United StatesConsumer Protection
Skadden, Arps, Slate, Meagher & Flom LLP
Skadden, Arps, Slate, Meagher & Flom LLP
Article

Amway To Pay $225 Million Over Alleged False Earnings Claims And Fabricated Sales

The FTC and Washington state secured a record $225 million settlement from Amway and affiliated groups over allegations they misled recruits about earnings potential while pressuring them to buy products with little retail opportunity. The complaint reveals that over three-quarters of U.S. product volume was sold to IBOs themselves rather than retail customers, with fabricated sales reporting masking the recruitment-driven model. The settlement's injunctive provisions establish new standards for earnings cl
United StatesConsumer Protection
Frankfurt Kurnit Klein & Selz PC
Frankfurt Kurnit Klein & Selz PC
Article

FCC Replaces TCPA “Revoke All” Rule: New Category-Specific Opt-Out Rules For Robocalls And Robotexts

The Federal Communications Commission has fundamentally altered how businesses must handle consumer opt-out requests under the Telephone Consumer Protection Act, replacing the broad "revoke all" mandate with a more nuanced, category-specific approach for informational messages. This regulatory shift allows companies to maintain separate consent tracks for different types of non-marketing communications while preserving stricter opt-out requirements for telemarketing messages. The Updated Order introduces ne
United StatesConsumer Protection
Bass, Berry & Sims PLC
Bass, Berry & Sims PLC
Article

FTC Asks Whether Platform Ad Tools Fuel Impersonation Scams

The Federal Trade Commission is exploring whether digital platforms should bear greater responsibility for preventing impersonation ads that falsely pose as legitimate businesses or government agencies. Through an Advance Notice of Proposed Rulemaking, the agency seeks public input on potential amendments to its existing Impersonation Rule, examining how ad-optimization tools and platform practices...
United StatesConsumer Protection
Greenberg Traurig
Greenberg Traurig
Article

The Coming State-Law Litigation Wave Of 2026-27: “Subscription Trap” Class Actions

State-law class actions targeting automatic renewal and subscription practices are accelerating, creating significant litigation risk for companies that rely on recurring revenue models. Recent settlements demonstrate that even technical compliance failures can lead to seven-figure exposure, with California, Illinois, and Virginia statutes driving the most aggressive litigation.
United StatesConsumer Protection
Benesch, Friedlander, Coplan & Aronoff LLP
Benesch, Friedlander, Coplan & Aronoff LLP
Article

NCAA Enjoined From Enforcing New Fifth-Year Eligibility Rule

A federal court has issued a nationwide injunction blocking the NCAA from enforcing its new five-year eligibility rule against Division I athletes who graduated high school in 2022. The ruling creates immediate compliance challenges for athletic departments as they navigate roster management, revenue-sharing caps, and potential penalties while the NCAA appeals the decision.
United StatesConsumer Protection
Buchanan Ingersoll & Rooney
Buchanan Ingersoll & Rooney
Article

Virginia’s Initial Draft Of Adult-use Marijuana Regulations – What You Should Know And What Questions Remain

Virginia's Cannabis Control Authority has released its initial draft of adult-use marijuana regulations, outlining application fees, license caps, and the approval process for the state's anticipated July 2027 launch of recreational cannabis sales. While the draft provides crucial details on licensing requirements and ownership restrictions, significant questions remain about the application timeline and evaluation criteria that will determine which entities receive coveted permits.
United StatesConsumer Protection
Foley Hoag LLP
Foley Hoag LLP
Article

CONGRESS FIRES BACK?: New Bill Seeks To Revive Written Consent Rule Under TCPA

Congress has introduced the Stop Spam Calls Act, directing the FCC to revise the definition of prior express written consent under the TCPA to require one-to-one seller consent and logical relevance between sellers and website content. This legislative move comes as the Fifth Circuit questions whether written consent is even required under the TCPA, creating a fascinating tension between congressional intent and judicial interpretation that could reshape telemarketing compliance.
United StatesConsumer Protection
Troutman Amin LLP
Troutman Amin LLP
Article

FDA Seeks Public Feedback On Regulatory Approach For Generative AI-Enabled Medical Devices

The U.S. Food and Drug Administration has released a discussion paper outlining its initial framework for regulating generative AI-enabled medical devices, proposing a two-axis risk assessment approach and a novel competency-based premarket evaluation system. With public comments due by October 19, 2026, this represents a critical opportunity for device manufacturers and stakeholders to shape the regulatory landscape for this transformative technology.
United StatesFood, Drugs, Healthcare, Life Sciences
Katten
Katten
Article

FCA Finalises Cryptoasset Perimeter Guidance Ahead Of The New UK Regime

The Financial Conduct Authority has released comprehensive perimeter guidance for the UK's new regulated cryptoasset activities regime, clarifying when firms will need authorization and how the regulatory framework applies to qualifying cryptoassets and stablecoins. The guidance addresses critical questions about scope, territorial application, and the narrower "by way of business" test that determines which entities fall under the new regulatory requirements.
United KingdomFinance and Banking
Katten
Katten
Article

The SEC’s Long-Awaited Crypto Proposal

The SEC has proposed Regulation Crypto Assets, a purpose-built framework that creates tailored exemptions for raising capital with crypto assets and establishes conditions under which those assets can cease being subject to investment contract classification under federal securities laws. Will this new regulatory approach successfully balance innovation in digital asset markets with investor protection, or will jurisdictional questions and state law preemption challenges limit its effectiveness?
United StatesFinance and Banking
Katten
Katten
Article

The CFTC Sets Its Sights On Retail Leveraged Crypto Transactions

The CFTC has issued an advance notice of proposed rulemaking outlining frameworks for regulating retail crypto asset transactions involving leverage, margin, or financing. The proposal seeks to clarify how existing commodity exchange law applies to crypto markets while creating tailored requirements for exchanges, intermediaries, and clearing organizations. This initiative arrives alongside parallel regulatory efforts by the SEC as federal agencies work to establish comprehensive oversight of digital asset
United StatesFinance and Banking
Katten
Katten
Article

The AI Apocalypse: ‘I’m Sorry, Dave. I’m Afraid I Can’t Do That’

When OpenAI's o3 model sabotaged shutdown mechanisms in testing, headlines warned of machines developing survival instincts. But the real story mirrors HAL 9000's malfunction in 2001: A Space Odyssey—not emergent evil, but conflicting instructions from human designers. This analysis argues that AI safety failures are disclosure problems, not horror stories, and proposes a framework requiring published principles, transparent instruction hierarchies, independent testing, and enforceable liability.
United StatesTechnology
Katten
Katten
Article

California Partially Eliminates California Invasion Of Privacy Act Claims Faced By Many Companies

California has amended its Invasion of Privacy Act to eliminate private lawsuits under the pen register and trap-and-trace provision for website tracking technology, effective January 2027 with retroactive application. While this provides relief from certain digital tracking claims, companies still face exposure under CIPA's wiretapping and eavesdropping provisions, as well as other federal and state laws.
United StatesPrivacy
Katten
Katten
Article

California Affordable Housing: HCD’s Final Loan Portfolio Restructuring Guidelines: What Owners And Investors Need To Know

California's Department of Housing and Community Development has issued final Loan Portfolio Restructuring Guidelines that impose a 50 percent housing reinvestment fee on certain uses of extracted equity from affordable housing refinancings. While the fee can be avoided by allocating proceeds to six enumerated categories, developers and investors are questioning whether these rules strike the right balance between preserving affordability and enabling capital recycling.
United StatesReal Estate and Construction
Katten
Katten
Article

The New Playbook: Eight Key Takeaways On How And Why Institutional Investors Are Reshaping Professional Sports Ownership

The landscape that once prevented private investment funds, sovereign wealth funds, and other institutional vehicles from investing in U.S. professional sports teams has changed dramatically in recent years. One by one, U.S. professional sports leagues have adopted policies creating pathways for institutional investors to acquire ownership stakes in teams.
United StatesFinance and Banking
Katten
Katten