California Privacy Protection Agency Signals Delay for Final CPRA Rules & California AG Conducts CCPA Investigative Sweep

Change is coming to the California privacy legal landscape in fits and starts.

California Privacy Protection Agency Indicates Delay for Final CPRA Regulations

The California Privacy Protection Agency (“Agency”) was established by the California Privacy Rights Act of 2020 (“CPRA”). The Agency began meeting in June 2021 (after board members were appointed in March 2021) and met most recently on February 17, 2022. The CPRA requires the Agency to adopt final CPRA regulations by July 1, 2022, but the Agency will not take over the California Attorney General’s (“AG”) rulemaking authority until April 2022. This leaves the Agency only three months to adopt the final regulations. As reported in Bloomberg, the Executive Director of the Agency, Ashkan Soltani, indicated at the February 2022 meeting that the Agency does not expect to meet the July 1, 2022 deadline. Instead, the Agency anticipates the rulemaking to be complete in the third or fourth quarter of 2022.

While this delay may complicate compliance strategies for companies that are subject to the CPRA, the underlying transparency, choice and consumer protection policy objectives of the CPRA and the California Consumer Privacy Act (“CCPA”) remain intact. Those objectives are embodied in tools that give consumers power to control how their information is used, particularly when it is shared throughout the AdTech ecosystem. We expect to see enforcement continue without delay, with the AG having recently announced its first public CCPA investigative sweep.

California AG Announces First Public CCPA Investigative Sweep

On January 28, 2022, the AG announced an investigative sweep into a number of businesses operating loyalty programs that the AG has alleged do not comply with the CCPA. The CCPA allows businesses to offer financial incentives—such as loyalty programs—to California consumers in exchange for such consumers’ personal information. However, businesses that offer financial incentives to consumers must notify consumers of the financial incentives and disclose the material terms of the financial incentive program prior to the consumer opting-in to the program. Consumers must also be permitted to revoke their consent at any time. The AG stated that recipients of the notices of alleged noncompliance included major corporations in the retail, home improvement, travel and food services industries. Under the CCPA, recipients of these notices have 30 days to come into compliance with the law.

Key Takeaways

We anticipate that companies will not see final CPRA regulations before September 2022 at the earliest and believe companies should remain agile and prepare for limited time between the final CPRA regulations being adopted and the CPRA going into effect on January 1, 2023. Companies will want to stay informed and monitor CPRA developments, including those associated with the rulemaking packages, public hearings and comment periods. In the meantime, companies will need to continue to monitor their compliance with the CCPA given the AG’s continued enforcement of the statute.