Updates to the California Consumer Privacy Act of 2018

We introduced the California Consumer Privacy Act of 2018 (CCPA) before, and there has been some updates since then.  While the CCPA was to take effect on January 1, 2020, the date of effectiveness and the date when the California Attorney General has to promulgate the regulations for same has been pushed back to July 1, 2020.  Similarly, the time of enforcement of same is to be that date if the regulations are published then and if not, then six months from the date of publication of the regulations.


There was lobbying in California regarding the private right of action in the CCPA and there was some language added to clarify the limits of consumer suits against companies.

On the federal level, Senator Marco Rubio introduced what he called the American Data Dissemination Act (and used the acronym “ADD Act”), which he presents as a federal data protection bill which would require the FTC to promulgate national regulations on data protection and would explicitly preempt state laws like the CCPA. It is to be based on the antiquated Privacy Act of 1974. Its unclear without specific statutory language or regulations on the ADD Act to determine the reasons for its genesis. If it were to follow the European model, an entirely new statutory scheme would likely be needed. The purpose could also be to halt the rise of 50 different data protection laws, one from each state. In any event, the members of Congress have been getting heavily lobbied by the US Chamber of Commerce and other business groups. It should be interesting to see how it all plays out. Companies should not however, presume that the CCPA will be pre-empted and should begin to prepare for same now.  

Overview of US Privacy Law

One of the current and future hot button legal issues is privacy law.  As technology progresses, how it intertwines with privacy rights is going to be an interesting area.  There are many instances where people knowing and willingly forego certain rights to privacy, like allowing certain apps to track their movements or share certain information with the world.  There are many instances where people give up part of their privacy rights without even knowing it.

There are a host of areas that people in the United States think of as “privacy” rights, some of which are (1) our individual right to choosing to be alone (to not be taped or viewed in private), (2) decisional privacy (right to contraception, access to abortion, right to marry whomever you choose, right to procreate), (3) information privacy (right to not have your information disclosed to third parties), and (4) others. Each of the privacy rights that we hold as individuals may arise from different areas of law including constitutional law, statutory law, agency regulations and even social norms. Read more