California Court Greenlights Enforcement of New Privacy Regulations
On February 9, 2024, a California state appeals court reversed a lower court's decision to put a hold on the California Privacy Protection Agency’s ability to enforce new regulations.
The California Privacy Protection Agency ("CPPA") will be able to immediately enforce regulations issued under the California Consumer Privacy Act ("CCPA"), as amended, after a recent California appeals court decision reversed a lower court’s decision that halted the enforcement of the regulations.
By way of background, in 2020, California voters approved the California Privacy Rights Act ("CPRA"), which significantly amended the CCPA, and created the CPPA to establish new privacy regulations on topics related to data processing agreements, deceptive user interface elements, and global opt-out preference signals, among others. Under the CPRA, these regulations were supposed to be adopted by July 1, 2022, with enforcement of the regulations starting on July 1, 2023. However, notwithstanding that the adoption of finalized regulations on most topics was delayed until March 29, 2023, the CPPA announced that it still intended to begin enforcement of the finalized regulations on July 1, 2023.
In response, a lawsuit was filed asking a California superior court to delay enforcement on published regulations until March 29, 2024—a full year after the CPPA issued the finalized regulations—and for a full year enforcement delay after future regulations are issued. The superior court agreed on both fronts.
The CPPA appealed this ruling and argued that the superior court erred by interpreting the CPRA as requiring a one-year enforcement delay because there was no clear, express statutory language requiring a one-year delay. In a decision filed on February 9, 2024, the appeals court agreed and reversed the superior court. Despite acknowledging that the CPPA failed to comply with the terms of the CPRA in its failure to issue regulations by July 1, 2022, the appeals court found that there was no statutory language unambiguously requiring a one-year delay between issuance and enforcement of regulations.
As a result of the appeals court’s decision, the regulations already published and finalized by the CPPA have now become immediately enforceable. Specifically, privacy regulations on topics related to data processing agreements, deceptive user interface elements, and opt-out preference signals, among others, are enforceable. More information about future regulations can be found in our related Commentary. Businesses should ensure that they are in compliance with the provisions of the finalized regulations to reduce regulatory enforcement exposure. In addition, the appeals court’s decision allows the CPPA to begin enforcing any future regulations shortly after being finalized rather than having to wait one year.
