California Privacy Rights Act Regulations Delayed

Written by: Brock Wolf, Esq. 

Last month, on February 17, the California Privacy Protection Agency (“CPPA”) announced at a board meeting that the publication of final regulations under the California Privacy Rights Act (“CPRA”) will be delayed.  Under the CPRA, regulations were to be finalized by July 1, 2022.  The goal was to provide businesses six (6) months to ensure their compliance ahead of the law’s January 1, 2023 effective date.  The CPPA, the agency tasked with implementing the CPRA, has cited difficulties in launching the agency and hiring staff as causing the delay.

The CPPA indicated that final regulations will not be published until the third or fourth quarter of this year.  The CPPA also stated that draft regulations may not be released until June of this year.  Although the delay in releasing regulations will give businesses a small window to ensure compliance ahead of the January 1 effective date, businesses will still have a grace period before enforcement begins.  Enforcement of the CPRA will not being until July 1, 2023, and will only apply to violations that occur on or after that date.

While we await the specifics, businesses should be prepared to generally address the following rights consumers will have under the CPRA:

• The right for consumers to “opt out” of sharing personal information.
• The right for consumers to opt out of certain uses and disclosures of “sensitive personal information.” Sensitive personal information is that which reveals a consumer’s: Social Security number, driver’s license, state ID card or passport number; financial account logins or account numbers; precise geolocation; racial or ethnic origin; religious or philosophical beliefs; contents of email and/or text messages; genetic, biometric, health, and sexual health or orientation data.
• The right for consumers to correct inaccurate personal information; and
• The right to enhanced transparency about a business’s information practices, including disclosing information about data retention periods.