Sacramento Court Rules CPPA Must Delay Enforcement of New Regulations

On June 30, 2023, a Sacramento Superior Court ruled that the California Privacy Protection Agency (CPPA) must wait a full one-year period from a regulation going into effect before enforcing it.  The one-year gap allows businesses to make necessary adjustments to comply with new regulations. 

The CPPA, which was formed in 2020 under the California Privacy Rights Act of 2020 (CPRA), finalized its first set of rules on March 29, 2023.  After the delay in publishing the final regulations, the California Chamber of Commerce (CalChamber) brought suit against the CPPA to enjoin it from bringing enforcement actions under CPRA regulations.  The CalChamber argued the CPPA needed to provide businesses with a 12-month period to comply with new CPRA regulations.

The court agreed that voters intended for there to be a gap between final regulation adoption and enforcement.  The court concluded it would be unfair to enforce regulations against businesses before businesses have had time to understand and adopt to new regulations.  Under the ruling, the CPPA must craft enforcement deadlines that are connected to the implementation date of individual rules.  The enforcement deadline must be a full 12 months after the date the rule becomes effective.