Enforcement of California regulations delayed to 2024

Want to receive these weekly privacy recaps in your inbox? Sign up for our privacy newsletter, A Little Privacy, Please.

United States

Connecticut and Colorado Privacy Laws Take Effect

July 1 marked the effective date of the Colorado Privacy Act and the Connecticut Act Concerning Personal Data Privacy and Online Monitoring, the third and fourth comprehensive privacy laws to go into effect, after California and Virginia.

Colorado has finalized rules under the Colorado Privacy Act, which also went into effect July 1. 

Stay up to date with all effective deadlines coming up for U.S. state privacy laws.

TAKEAWAY

The Colorado and Connecticut laws are more similar to Virginia’s law than California’s, but they each borrow certain elements from both Virginia and California and introduce some new elements.

For example, like California (and unlike Virginia) the Colorado and Connecticut laws will require recognition of opt-out preference signals, although not until July 1, 2024 and January 1, 2025, respectively.

Like Virginia (and unlike California), the Colorado and Connecticut laws require opt-in consent for the processing of sensitive data, but the Connecticut law also borrows an element from GDPR, requiring controllers to provide a mechanism to revoke consent as easily as providing it. 

California Regulation Enforcement Delayed to March 2024

Enforcement of regulations issued in March 2023 by the California Privacy Protection Agency (CPPA) pursuant to the California Privacy Rights Act was set to begin July 1, 2023, but a petition by the California Chamber of Commerce to delay such enforcement was granted by a California Superior Court, pushing the enforcement date to March 29, 2024, one year after the regulations were finalized.

CONTEXT + TAKEAWAY

Although the California Privacy Rights Act (the “CPRA”, which amends the California Consumer Privacy Act, the “CCPA”) has technically been in effect since January 1, 2023, it contains a provision prohibiting enforcement until July 1, 2023, which “shall apply to violations occurring on or after that date”.

However, the CPRA also required that the CPPA adopt final implementing regulations by July 1, 2022, which deadline the agency missed by almost nine months.

The California Chamber of Commerce argued (and the Court agreed) that giving companies only three months to comply with the regulations did not align with the intent of the legislation.

The Court ruled, therefore, that regulations (both now existing and any that may be implemented in the future) shall not be enforced until twelve months after the given regulations are approved.

Accordingly, the regulations approved in March 2023 may not be enforced until March 2024, and any future regulations approved by the CPPA may not be enforced until twelve months after the date of such approval.

An important aspect to remember though is that this ruling only applies to regulations under the CPRA; the CPRA statute (minus its regulations) and the CCPA and its regulations may still be enforced. 

Delaware Sends Comprehensive Privacy Bill to Governor

Delaware HB 154, which implements the Delaware Personal Data Privacy Act, passed the House and Senate. If signed by the Governor, the law will take effect January 1, 2025. 

TAKEAWAY

The Act largely resembles Connecticut’s and Montana’s privacy laws, including obligations to obtain opt-in consent to process sensitive data, to provide mechanisms for users to revoke consent as easily as providing it, and to respect opt-out preference signals.

The opt-out preference signal requirement would not kick in until January 1, 2026 in Delaware, however, one year later than in Connecticut and Montana. 

Want more of the privacy highlights that matter to adtech and martech? Sign up for our privacy newsletter, A Little Privacy, Please.

A Little Privacy, Please weekly recaps are provided for general, informational purposes only, do not constitute legal advice, and should not be relied upon for legal decision-making. Please consult an attorney to determine how legal updates may impact you or your business.