Data Privacy

Despite Late Changes and COVID-19, CCPA Enforcement Date Remains July 1

April 20, 2020 – With additional changes to the regulations still in administrative review and businesses grappling with pressing COVID-19 issues, a group of nearly 100 advertising trade associations, organizations and companies asked California Attorney General Xavier Becerra (D) to delay the July 1 enforcement date for the California Consumer Protection Act (CCPA). But it seems Becerra is unmoved by this request, even as California Governor Gavin Newsom (D) issued an Executive Order giving the state’s Office of Administrative Law (OAL) an additional 60 days to complete the CCPA regulatory process.

The March 30 Executive Order issued by Newsom states that the deadlines “related to the filing, refiling, certification and/or review of regulations and emergency regulations, are extended for a period of 60 calendar days to allow state agencies additional time to finalize regulatory changes pursuant to the Administrative Procedure Act.”

When asked by Forbes about the group’s request to delay enforcement of the CCPA’s online data privacy protections, an advisor to Becerra said that “there are no current plans to delay enforcement.”

“’Right now, we’re committed to enforcing the law upon finalizing the rules or July 1, whichever comes first,’ the advisor said in an email to Forbes. ‘We’re all mindful of the new reality created by COVID-19 and the heightened value of protecting consumers’ privacy online that comes with it. We encourage businesses to be particularly mindful of data security in this time of emergency.’”

“While we agree that the pandemic reinforces the need for protecting consumer privacy, the combination of the financial stress of this unprecedented crisis and the long delays in defining how the CCPA is to be enforced put communication agencies and their clients in a difficult position,” stated Jon Bigelow, executive director of the Coalition for Healthcare Communication.

The CCPA, which went into effect on Jan. 1, 2020, currently has an enforcement date of July 1, but final regulations have not yet been issued. A third comment period on the draft regulations ended on March 27, and if additional changes are made by the AG and submitted to the OAL, the OAL usually has 30 days to review those changes.

An April 10 blog post by Association of National Advertisers (ANA) EVP of Government Relations Dan Jaffe states that because regulations generally go into effect on a quarterly schedule in California, if the OAL final review is pushed past May 31, the regulations’ effective date could be extended to Oct. 1. The ANA is one of the advertising trade groups that appealed to the AG’s office to delay enforcement until Jan. 2, 2021.

“Despite the extraordinary, almost unprecedented challenges facing our nation and the world due to the dire public health and economic hardships brought on by the COVID-19 pandemic, the California Attorney General (AG) continues to indicate that there will be no delay by his office in the enforcement of the CCPA regulations,” Jaffe stated.

Alison Pepper, EVP, government relations, for the 4A’s, told the Coalition that if the OAL is backed up and cannot review and file the final regulations in a timely manner – i.e., if it takes the usual 30 days plus a 60-day extension under the Executive Order – the effective date for CCPA enforcement will go past July 1, but she said it seems clear that this is not what Becerra wants. “It looks like the AG is committed to July 1 as the enforcement date, but we’ll have to wait and see when the OAL finishes its review,” Pepper said.

It is worth noting that advertisers are not the only entities reaching out to Becerra: Consumer groups have asked him to not delay enforcement. And, it seems that Becerra views the COVID-19 pandemic not as a reason to delay enforcement but as an additional motive to keep enforcement on schedule. On April 10, he issued an alert reminding consumers “of their data privacy rights amidst the COVID-19 public health emergency.”

However, Jaffe stated in his blog that if enforcement begins on July 1, “the business community could be in a very difficult position … by either having to comply with a rule that’s just recently been completed or even worse without the benefit of finalized regulations implementing the CCPA’s terms.”