United States: CCPA Regulations Now Effective: California OAL Gives Highly-Anticipated Approval

On March 30, 2023, the California Privacy Protection Agency (CPPA) announced that the California Office of Administrative Law (OAL) has approved the CPPA's regulations and filed them with the Secretary of State, completing the rulemaking process.

Effective immediately, the approved regulations are intended to implement the California Consumer Privacy Act (CCPA) and update it in order to bring it into line with the California Privacy Rights Act (CPRA). The updates harmonize the CCPA regulations with the CPRA's changes and operationalize the new rights and concepts that the CPRA introduced. The approved regulations also provide additional clarification and guidance to implement the law, and reorganize and consolidate requirements to make them more understandable.

The CPPA initiated the rulemaking process on July 8, 2022, and released subsequent drafts in fall 2022 and in 2023 after reviewing stakeholder comments and holding public meetings. The CPPA approved the final draft of the regulations on February 3, 2023, and filed the final rulemaking package with OAL for approval on February 14, 2023. A few days later, the CPPA issued a request for public commentary on future rulemaking topics, including: cybersecurity audits, risk assessments and automated decision-making (see here for more details).

Its rulemaking complete, the CPPA has stated that it will be looking to advance public awareness of new rights and obligations under the law, with CPPA Executive Director Ashkan Soltani expressing a willingness to "redouble our efforts to promote public awareness."¹ Companies should familiarize themselves with the new regulations, and prepare their compliance efforts in areas such as opt-out preference signals, dark patterns, service provider contracts and data minimization, among others.

The final regulations and supporting materials are expected to be available on the CPPA website next week.

Please contact a member of Akin's cybersecurity, privacy and data protection team if you have any questions about these regulations or how they may affect your company.

See our latest CCPA Litigation and Enforcement Report for details about the third year of civil litigation and administrative enforcement related to the CCPA.

Footnote

1. California's Office of Administrative Law Approves CCPA Regulations, California Privacy Protection Agency, News & Announcements (March 30, 2023), available at https://cppa.ca.gov/announcements/.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.