On February 3, 2023, the California Privacy Protection Agency (CPPA) Board of Directors voted unanimously to adopt and approve the Agency’s rulemaking package, as amended, to continue implementation of the California Consumer Privacy Act (CCPA) and to update existing regulations.
The rulemaking package includes draft final regulations as well as a draft final statement of reasons (FSOR) and appendices containing responses to comments received during public comment periods.
To complete the rulemaking process, the board also directed staff to file the final rulemaking with the California Office of Administrative Law (OAL) within the next two weeks.
The proposed regulations will not go into effect until approved by the OAL, which will have 30 business days to review them once received. Consistent with the timelines prescribed by the California Administrative Procedures Act, the earliest the proposed regulations could become effective is April 2023.
However, this estimate is subject to change. If the OAL did not approve the final rulemaking package, for example, CAPP would have an additional 120 days to address any deficiencies.
The formal rulemaking process to adopt the proposed regulations began on July 8, 2022. The proposed regulations revise existing CCPA provisions to align with CCPA amendments adopted under Proposition 24, the California privacy rights law.
At its February 3, 2023 meeting, the Board also voted to seek public comment prior to the adoption of the regulations regarding cybersecurity audits, risk assessments, and automated decision-making.
