One Step Closer: California AG Submits Final Proposed CCPA Regulations for Approval and Requests Expedited Review

The implementing regulations under the California Consumer Privacy Act of 2018 (CCPA) are one step closer to taking effect, following California Attorney General (AG) Xavier Becerra’s submission of final proposed regulations to the California Office of Administrative Law (OAL) for its review and approval. The final proposed regulations are substantively unchanged from the second modified draft regulations that the AG’s office issued on March 11, 2020 (which our team summarized in a previous client alert).

Consistent with the CCPA’s requirement that the AG adopt initial regulations by July 1, 2020, as well as AG Becerra’s public commitment to begin enforcing the CCPA on July 1, 2020, AG Becerra has requested an expedited process:

1. Request for OAL to conduct an expedited review of the proposed regulations. By statute, OAL has 30 business days to review proposed regulations for compliance with the California Administrative Procedure Act. An executive order, issued in response to the COVID-19 pandemic, extended this period by an additional 60 calendar days. However, AG Becerra has requested that OAL complete its “review within 30 business days, given the statutory mandate” to promulgate regulations by July 1, 2020.
2. A Request for the regulations to take effect when filed with the California Secretary of State. Once approved by OAL, final regulations are filed with the Secretary of State. Generally, regulations become effective on one of four quarterly dates based on the timing of this filing:[1]
   1. January 1, if filed between September 1 and November 30;
   2. April 1, if filed between December 1 and February 29;
   3. July 1, if filed between March 1 and May 31; or
   4. October 1, if filed between June 2 and August 31.

The final CCPA regulations, if approved, would thus ordinarily be expected to take effect on either October 1, 2020 or January 1, 2021 (depending on OAL’s approval date). However, the AG has requested that the regulations take effect concurrently with their filing with the Secretary of State. Coupled with the request for an expedited OAL review, the regulations could take effect much sooner, perhaps even before July 1, 2020.

It is unclear whether OAL will expedite its review of the AG’s proposed final CCPA regulations, or when the CCPA regulations may become effective if or when they are approved. Notably, however, the AG is empowered to begin enforcing the CCPA on July 1, 2020, regardless of whether the CCPA regulations have been approved by that date. Moreover, AG Becerra affirmed in a press release yesterday that his office is “committed to enforcing [the CCPA] starting July 1.” Accordingly, CCPA-covered businesses should not expect the AG to delay enforcement activity under the CCPA.

The AG’s Proposed Regulations Package—including a final Statement of Reasons and the AG’s formal request for an expedited review and earlier effective date—is accessible here. For additional information and guidance, be sure to visit our CCPA Resource Center.

[1] See the AG’s “Information about the CCPA Rulemaking Process” fact sheet, which links to an overview of the OAL process and timeline.