The Court of Appeal of the State of California (the Court of Appeals) recently ruled that Proposition 24, the California Privacy Rights Act of 2020 (CPRA), is enforceable without any further delay. The CPRA contains important changes to the California Consumer Privacy Act, including with respect to online advertising.
The Court of Appeals, reviewing a ruling by a trial court that the enforcement date of the CPRA was to be delayed for one year from adoption, rather than enforceable on July 1, 2023, determined that there was “no clear, unequivocal language mandating a one-year delay” and there was no basis to determine that the “voters contemplated a one-year delay in enforcement connected to the approval of final regulations.”
The text of the CPRA called for final regulations to be put in place by July 1, 2022 with enforcement with respect to areas of the CPRA covered by the regulations to begin on July 1, 2023, creating a one-year grace period. However, the final regulations were not put in place until March 29, 2023. An initial ruling by the trial court determined that, given the effective date of the regulations, the enforcement date would also be delayed until March 29, 2024.
The decision was appealed by, among others, the new California Privacy Protection Agency (the Agency) on the basis that the trial court erred in its decision that the CPRA prohibited the Agency from enforcing the CPRA for one year. For reasons further described in the full decision and highlighted below, the Court of Appeals agreed.
The Court of Appeals noted that the CPRA did not “unambiguously require a one-year gap” before the Agency could begin enforcement and, rather, the CPRA clearly stated that enforcement could begin on July 1, 2023. Further, the Court of Appeals noted that the reason for the one-year gap in the original CPRA, if the final regulations had been adopted on July 1, 2022, are not expressly set forth and they could have included time for the Agency to prepare to enforce the regulations, give companies time to comply, etc.
Finally, the Court of Appeals looked to the support for the CPRA, stating that “voters intended to strengthen and protect consumers’ privacy rights regarding the collection and use (including sale) of their personal information” and that the Agency’s enforcement was supported.
As the end of February draws near and the original delayed enforcement date that a company subject to the CPRA would have had to be compliant by approaches, the ruling by the Court of Appeals gives the Agency the ability to enforce the full CPRA immediately, without any further delay, making compliance with the CPRA that much more important for companies that are subject to the California Consumer Privacy Act as amended by the CPRA.
Note that on February 20, 2024 the California Chamber of Commerce appealed the Court of Appeals’ ruling to the Supreme Court of the State of California asking that the Court of Appeals decision be de-published.