In light of the rapidly changing coronavirus (COVID-19) situation, Troutman Sanders and Pepper Hamilton have postponed the effective date of their previously announced merger until July 1, 2020. The new firm – Troutman Pepper – will feature 1,100+ attorneys across 23 U.S. offices. Read more.


Insight Center: Publications

CCPA Regulations Likely Not Effective Until October 1

Client Alert

Authors: Wynter L. Deagle, Sharon R. Klein, Alex C. Nisenbaum, Ronald I. Raether, Anne-Marie Dao and Sadia Mirza

CCPA Regulations Likely Not Effective Until October 1

Businesses awaiting final California Consumer Privacy Act (CCPA) regulations will likely be waiting until after enforcement of the CCPA begins on July 1.

Prior to the regulations taking effect, the attorney general must submit proposed regulations to the state Office of Administrative Law (OAL) for review for compliance with the State Administrative Procedures Act. Once submitted, OAL typically has 30 working days to conduct its review and then either approve the rulemaking action and file the proposed regulation with the Secretary of State or disapprove the rulemaking action. Governor Gavin Newsom has extended this timeframe by an additional 60 days due to the COVID-19 pandemic. Generally, regulations become effective only on one of four quarterly dates based on when the final regulations are approved by OAL and then filed with the Secretary of State: January 1 (if filed between September 1 and November 30), April 1 (if filed between December 1 and February 29), July 1 (if filed between March 1 and May 31), and October 1 (if filed between June 1 and August 31). This means that, if the AG wants CCPA regulations to become effective July 1, they must be filed with OAL, approved by OAL and submitted to the Secretary of State by May 31.

As of this writing, there are only 10 days left until the filing deadline and the AG has not submitted final CCPA regulations to OAL for review. To make the originally-anticipated July 1 effective date, the AG could, theoretically, submit final regulations in the next nine days and ask OAL for expedited review or submit the final regulations late and ask for the July 1 effective date based on “good cause” for earlier enforcement. OAL, however, already has a long list of 55 regulations slated for review. It is also unclear how receptive OAL would be to expediting regulations that (as of the last draft) are nearly 30 pages long. Accordingly, the effective date of the CCPA regulations will likely slip until October 1.

The lack of final regulations creates additional uncertainty for businesses seeking to comply with a statute and regulations fraught with contradictions and ambiguities. Given that the AG has committed to enforcing the CCPA starting on July 1, it would be unwise for businesses to wait for final regulations to finish preparing for compliance. Instead, as we previously discussed, where the CCPA is unclear on its own requirements, businesses should consider reviewing past interpretations and enforcement of other privacy laws for guidance.

The bottom line is that businesses need to approach compliance efforts in a manner that is reasonable, defensible and informed. And while it is unlikely that the final regulations will be guiding that effort prior to the start of enforcement, the draft regulations are still instructive.

The material in this publication was created as of the date set forth above and is based on laws, court decisions, administrative rulings and congressional materials that existed at that time, and should not be construed as legal advice or legal opinions on specific facts. The information in this publication is not intended to create, and the transmission and receipt of it does not constitute, a lawyer-client relationship.

Data protection laws have changed, so we have revised our Privacy Policy.