The anticipated finalization of California Privacy Rights Act regulations has been pushed back again.

While the CPRA takes effect in just under two weeks — on Jan. 1, 2023 — the California Privacy Protection Agency is still working to promulgate final rules. During a Dec. 16 board meeting, CPPA Executive Director Ashkan Soltani said the final rules will likely be released in late January. Under that timeline, with a 30-day review by the California Office of Administrative Law, the regulations would take effect around April. In February, Soltani announced the agency would miss its July 1 deadline for finalizing the rules.

The CPPA recently approved modifications to the draft regulations and Soltani said staff is reviewing 55 letters received during a 15-day public consultation. Further changes to the draft recommendations are not anticipated, he added. Once staff review is complete, the proposed regulations should come before the board for final approval around the end of January.

The final rulemaking package — to include a Final Statement of Reasons and responses to all public comments throughout the process — would then be presented to the OAL in early to mid-February.

“OAL will have 30 days to review, meaning that if approved, the soonest the regulations could be in effect is in April,” Soltani said, adding  if OAL does not approve the proposed regulations, the CPPA would have an additional 120 days “to cure any deficiencies.”

CCPA board member Alastair Mactaggart stressed “time is the enemy here” and urged the board to “think about being satisfied” with the proposed rules when they are presented, and to consider any changes that may be needed under a future rule-making package.

Mactaggart said it's "critical" for the rulemaking package to make its way to the OAL quickly. 

“It’s good for the industry, for the community, for advocates, for everybody to know what’s coming down the pike,” he said.  

Covered entities have been concerned about compliance, with the CPRA taking effect Jan. 1 without the CPRA finalizing regulations. The board said existing regulations will be in effect until the final regulations are approved.

Loeb & Loeb Partner Jessica Lee, CIPP/E, CIPP/US, CIPM, recently told IAPP Staff Writer Joe Duball companies should “take the regulations as they are now and work to implement with the risk that there could be more change.”