The CCPA regulations approved by the Office of Administrative Law in March 2023 are now enforceable after a three-judge panel issued a ruling that lifted an enforcement delay. The regulations center on data processing agreements, consumer opt-out mechanisms, mandatory recognition of opt-out preference signals, dark patterns and consumer request handling. 

While the California Privacy Protection Agency (CPPA) included a potential discretionary enforcement mechanism in the regulations that allow it to consider all relevant facts, “including the amount of time between the effective date . . . and the possible or alleged violation(s)”, it is unclear if this would provide any leeway given the time since the regulations were finalized. 

Affected businesses should also note the CPPA is currently working on six other sets of regulations, including ones concerning cybersecurity audits, risk assessments and automated decision-making technologies.