The CCPA grants the California Attorney General (AG) the authority to enforce the CCPA starting on July 1, 2020. Last month, the AG confirmed no intention to delay that enforcement date due to the COVID-19 pandemic, despite mounting industry pressure.

Even if enforcement begins July 1^st, companies must contend with another glaring obstacle: the AG has not yet issued final regulations. The AG has a narrow window to complete its final regulations, leaving companies with less than three months advance notice to implement highly technical final regulations. If the AG fails to meet its statutory deadlines, the AG’s enforcement of the CCPA would begin before final regulations are issued.

In March, the AG released a third draft of CCPA regulations, with comments due on March 27^th. Now, the AG can either issue another round of proposed regulations or finalize the regulations. The third draft had far fewer changes than previous drafts, indicating the AG may be ready to finalize the regulations, although the AG has remained largely silent in explaining the reasoning behind any changes to its various drafts.

Once the AG is ready to issue final regulations, the AG will send the regulations to the Office of Administrative Law, which generally has up to 30 working days to review regulations, although an executive order linked to the COVID-19 crisis extends the Office’s deadline by 60 calendar days.

Once reviewed, the Office transmits the final rule to the Secretary of State for adoption. The effective date of the final CCPA regulations depends on the date that the Office files the regulations with the Secretary of State. For example:

If filed March 1 – May 31: the effective date is July 1.
If filed June 1 – August 31: the effective date is October 1.
Another effective date may be possible if the AG demonstrates good cause.

As a result of this timeline, the AG is likely aiming to complete the final regulations in April, to provide the Office with sufficient time to complete the rulemaking process by May 31^st and implement the regulations by July 1^st. Any delay could push the effective date of new rules to October 1^st, well past the statutory enforcement date of July 1.

Given this timeframe, companies seeking to comply with the new CCPA regulations should not wait for final regulations to stand up compliance processes. With enforcement slated to arrive either at the same time as or before the effective date of new regulations, covered businesses should work with privacy counsel to prepare for CCPA as soon as possible.

We will continue to follow new developments that may impact the timeframes for implementation of the CCPA regulations. If you have questions on how the regulations may impact your business, please contact Alysa Hutnik or Alex Schneider at Kelley Drye.

No Delay? What To Expect on CCPA Enforcement Timing