California pushes back CPRA enforcement to March 2024

In a surprising turn of events, enforcement of California's consumer data privacy law, the California Privacy Rights Act (CPRA), has been pushed from July 1st, 2023, to March 29th 2024.

The decision was made by the Sacramento County Superior Court a day before enforcement was scheduled to start last Saturday, following a complaint filed by the California Chamber of Commerce.

In a statement, the President and CEO of the California Chamber of Commerce explained that the California Privacy Protection Agency (CPPA) had accumulated delays in the rulemaking process (final regulations were supposed to be in place by 1 July 2022, but the first of at least two sets of CPRA regulations were only finalized in March this year), and that more time should be provided to businesses and organizations to get ready:

“Today’s ruling provides some certainty and basic fairness for California businesses as they work to comply with the complicated mandates called for in Proposition 24. In passing Proposition 24, voters understood that businesses should be provided time to implement new rules before any enforcement action is taken.

The Court underscored this today, recognizing that it would be unfair for the CPPA to enforce new regulations when the impacted businesses did not even know what was going to be required of them”

- Jennifer Barrera, President and CEO, California Chamber of Commerce (source: CalChamber)

This slows down the efforts made by the CPPA to lead the way in establishing comprehensive consumer data privacy laws in the U.S., a sentiment expressed by the agency's Executive Director in a statement issued after the decision to postpone CPRA enforcement was made public:

"Although we're disappointed the court granted the Chamber’s request to delay enforcement of portions of the regulations enacted earlier this year, the Agency remains committed to advancing the privacy rights of Californians and will take the appropriate next steps to safeguard the protections Californians overwhelmingly supported at the ballot box,"

- Ashkan Soltani, Executive Director at CPPA (source: Bloomberg Law)

While this comes as a surprise, CPRA enforcement being delayed to March 2024 can be seen as an opportunity, for businesses that hadn't properly prepared, to get ready for the new deadline. To learn more, check out this CPRA compliance checklist: