On June 30, 2023, the Superior Court of California, Sacramento County stopped enforcement by the California Privacy Protection Agency (the “Agency”) of final regulations promulgated under the California Privacy Rights Act (“CPRA”) for a period of twelve (12) months from the date that individual regulations become final. The Agency may not begin enforcing certain regulations until March 29, 2024, though enforcement of the statute may move forward as of July 1, 2023.
The CPRA amended the California Consumer Privacy Act of 2018 (“CCPA”), and the Agency promulgated certain regulations updating the CCPA regulations to address changes to the underlying statute. These were approved by the California Office of Administrative Law and came into force in March 2023. The Agency is now in the process of addressing other topics for rulemaking as required by the statute (e.g., pertaining to risk assessments, cybersecurity audits, and automated decision-making technology).
The court declined to require the Agency to complete its rulemaking processes for the remaining topics by a certain date, but it stayed enforcement of such future regulations for a period of twelve (12) months from the promulgation of final regulations in those subject areas.