CPRA Enforcement Delayed Until At Least March 29, 2024

Following a California Chamber of Commerce lawsuit, a Superior Court of California judge has delayed enforcement of the California Privacy Rights Act (CPRA) regulations until March 29, 2024. The suit argued that California voters intended for the California Privacy Protection Agency (CPPA) to issue regulations at least one year prior to the enforcement date on July 1, 2022. Instead, the regulations were issued on March 29, 2023 - some 9 months late. The court agreed with the plaintiff and has therefore delayed enforcement until one year following the issuance of the existing regulations, i.e., until March 29, 2024.

Moreover, the court said that the CPPA could not enforce areas of the law relating to portions of the CPRA that have not been addressed by the current regulations until at least one year after regulations are issued. Areas that have not been addressed include regulations for cybersecurity audits, risk assessments, and automated decision making.