Court Delays CPRA Rules Enforcement Into 2024

A California state court delayed enforcement of California Privacy Right Act (CPRA) regulations Friday. The CPRA had required the California Privacy Protection Agency (CPPA) to start enforcing regulations implementing the sequel to the California Consumer Privacy Act (CCPA) by Saturday.

The California Superior Court in Sacramento partly granted the stay request by the California Chamber of Commerce after a hearing Friday. The final decision closely tracked with a tentative ruling released Thursday in case 34-2023-80004106-CU-WM-GDS. The parties didn't comment right away.

The court paused “the Agency’s enforcement of any Agency regulation implemented pursuant to Subdivision (d) for 12 months after that individual regulation is implemented.” That means the CPPA may start enforcing rules it finalized March 29, 2023, on that date in 2024, said the court: The agency can start enforcing any rules to come 12 months after they’re finalized. CCPA rules will remain enforceable by the California attorney general.

The CPRA contemplated that final rules would be ready by July 1, 2022, and enforcement would begin July 1, 2023. Including the one-year-apart dates in CPRA "indicates the voters intended there to be a gap between the passing of final regulations and enforcement of those regulations,” the decision said. “The Court is not persuaded by the Agency’s argument that it may ignore one date while enforcing the other.”