Enforcement of California regulations delayed to 2024
July 4, 2023
Want to receive these weekly privacy recaps in your inbox? Sign up for our privacy newsletter, A Little Privacy, Please.
Connecticut and Colorado Privacy Laws Take Effect
July 1 marked the effective date of the Colorado Privacy Act and the Connecticut Act Concerning Personal Data Privacy and Online Monitoring, the third and fourth comprehensive privacy laws to go into effect, after California and Virginia.
Colorado has finalized rules under the Colorado Privacy Act, which also went into effect July 1.
For example, like California (and unlike Virginia) the Colorado and Connecticut laws will require recognition of opt-out preference signals, although not until July 1, 2024 and January 1, 2025, respectively.
Like Virginia (and unlike California), the Colorado and Connecticut laws require opt-in consent for the processing of sensitive data, but the Connecticut law also borrows an element from GDPR, requiring controllers to provide a mechanism to revoke consent as easily as providing it.
California Regulation Enforcement Delayed to March 2024
Enforcement of regulations issued in March 2023 by the California Privacy Protection Agency (CPPA) pursuant to the California Privacy Rights Act was set to begin July 1, 2023, but a petition by the California Chamber of Commerce to delay such enforcement was granted by a California Superior Court, pushing the enforcement date to March 29, 2024, one year after the regulations were finalized.
CONTEXT + TAKEAWAY
Although the California Privacy Rights Act (the “CPRA”, which amends the California Consumer Privacy Act, the “CCPA”) has technically been in effect since January 1, 2023, it contains a provision prohibiting enforcement until July 1, 2023, which “shall apply to violations occurring on or after that date”.
However, the CPRA also required that the CPPA adopt final implementing regulations by July 1, 2022, which deadline the agency missed by almost nine months.
The California Chamber of Commerce argued (and the Court agreed) that giving companies only three months to comply with the regulations did not align with the intent of the legislation.
The Court ruled, therefore, that regulations (both now existing and any that may be implemented in the future) shall not be enforced until twelve months after the given regulations are approved.
Accordingly, the regulations approved in March 2023 may not be enforced until March 2024, and any future regulations approved by the CPPA may not be enforced until twelve months after the date of such approval.
An important aspect to remember though is that this ruling only applies to regulations under the CPRA; the CPRA statute (minus its regulations) and the CCPA and its regulations may still be enforced.
Delaware Sends Comprehensive Privacy Bill to Governor
Delaware HB 154, which implements the Delaware Personal Data Privacy Act, passed the House and Senate. If signed by the Governor, the law will take effect January 1, 2025.
The Act largely resembles Connecticut’s and Montana’s privacy laws, including obligations to obtain opt-in consent to process sensitive data, to provide mechanisms for users to revoke consent as easily as providing it, and to respect opt-out preference signals.
The opt-out preference signal requirement would not kick in until January 1, 2026 in Delaware, however, one year later than in Connecticut and Montana.
Want more of the privacy highlights that matter to adtech and martech? Sign up for our privacy newsletter, A Little Privacy, Please.
A Little Privacy, Please weekly recaps are provided for general, informational purposes only, do not constitute legal advice, and should not be relied upon for legal decision-making. Please consult an attorney to determine how legal updates may impact you or your business.
Latest Blog Posts
California Attorney General Bonta announced a settlement with Doordash based on...
Explore the intricate landscape of Consent or Pay models...
A blog post from the FTC reminded companies that simply changing...
Latest White Papers
The current state of publisher compliance with CCPA, and...
How to review your vendor list to mitigate compliance...
Keep in touch
Sign up for our newsletter to keep up with privacy news for adtech and martech,
plus occasional company news.