California Consumer Data Privacy Bill on Hold Until March 2024

California’s first-in-the-nation privacy agency needs to wait until March 2024 to begin enforcing new regulations governing how businesses collect and use customers’ personal information after a superior court judge Friday ruled the California Privacy Protection Agency (CPPA) didn’t pass the regulations on time. The ruling comes a day before the CPPA was set to begin enforcement of the state’s landmark California Privacy Rights Act. It’s a victory for the California Chamber of Commerce, which filed a lawsuit challenging the enforcement plans, arguing that the agency broke its own law when it didn’t pass the regulations by July 1, 2022 and that California businesses wouldn’t have as much time as the law allows to prepare. 

The Chamber said voters intended a year between final regulations and enforcement, and Sacramento County Superior Court Judge James Arguelles agreed. The new law gives consumers more bargaining power with regard to businesses’ use of their personal data. Consumers can prevent the use of sensitive data, and opt out of the selling or sharing of their sensitive information. Those businesses that buy, receive or sell the personal information of more than 100,000 Californians, derive more than half of their revenue from selling personal information, or have a revenue of over $25 million, will be subject to the law.