Laws & Regulations

1.) The California Consumer Privacy Act

In November 2020, California voters passed Proposition 24, the California Privacy Rights Act ("CPRA"). The CPRA amends and extends the California Consumer Privacy Act of 2018 ("CCPA"). To implement the law, the CPRA established the California Privacy Protection Agency ("Agency") and vested it with the full administrative power, authority and jurisdiction to implement and enforce the California Consumer Privacy Act of 2018. The Agency’s responsibilities include updating existing regulations, and adopting new regulations.

• The CCPA (amended by the CPRA) – posted 4/2024
• Proposition 24 – Text, includes Findings and Declarations, Purpose and Intent
• Proposition 24 – Voter Guide

CCPA Regulations

• California Consumer Privacy Act Regulations – posted 4/2024
• Conflict of Interest Code

Completed Rulemaking Activity

• CPPA Pre–Rulemaking Activities on Cybersecurity Audits, Risk Assessments, and Automated Decisionmaking
• California Consumer Privacy Act Regulations
• Transfer of Rulemaking Authority & New Division for CPPA Regulations
• CPPA Pre–Rulemaking Activities

2.) Senate Bill 362 (2023), known as the “Delete Act”

On October 10, 2023, the Governor signed Senate Bill 362 into law. The law tasks the Agency with establishing a deletion mechanism that allows consumers to request from all data brokers the deletion of all non–exempt personal information related to the consumer through a single deletion request to the Agency.

The law also transferred the administration and enforcement of the Data Broker Registry from the Office of the Attorney General to the California Privacy Protection Agency (“Agency”) as of January 1, 2024. The Agency now maintains the Data Broker Registry and posts publicly the required information disclosed by data brokers. The Agency is authorized to promulgate rules to implement the Act.

• Senate Bill 362

Delete Act Regulations

• Data Broker Registration Fee – January 1, 2024

Pending Rulemaking Activity

• Data Broker Registration – Public Comment Period July 5 – August 20, 2024, 5:00 p.m. PST
• Notice of Proposed Rulemaking
• Text of Proposed Regulation
• Initial Statement of Reasons
• Economic and Fiscal Impact Statement (STD 399)

Complete Rulemaking Activity

• Data Broker Regulations – Registration Fee – Effective January 1, 2024