COVID-19 Isn't Delaying the Enforcement of the CCPA

CCPA graphic

Enforcement of the California Consumer Privacy Act (CCPA)—a law that gives California consumers the right to know what personal information businesses have about them, the right to request businesses to delete that information, and the right to opt out of the sale of their personal information—has NOT been put on hold even during the midst of the current pandemic.


At the end of March when COVID-19 was ramping up, a coalition of over 60 companies made a request to California’s attorney general to delay the enforcement of the CCPA for 6 months. However, the attorney general’s office responded saying that they have no current plans to delay enforcement—and the anticipated enforcement date is quickly approaching (July 1, 2020). Theoretically, businesses should have already been in full compliance with the regulation as of January 1, 2020 (considering the law’s “look-back” provisions), but many companies have been scrambling to adapt to all of the rapidly changing rules and still aren’t in full compliance yet.


It is important to note the major components of the CCPA, which include (1) the consumers’ rights to see the data a business is collecting about them, (2) for that data (and consumer) to be “forgotten”, and (3) the consumers’ rights to prevent the sale of their personal data. In addition to the obvious dangers, these regulations also create substantial new risks for marketers who use this kind of personal data for tracking and marketing measurement (such as Multi-Touch Attribution). Use of PII for marketing technology raises the risks of a PII data breach, increases the complexity for a brand’s compliance with CCPA, and creates more operational costs for handling and managing the PII.


As a result of the looming enforcement of these regulations, businesses should (1) attain compliance with the CCPA if they haven’t done so already, (2) continue to prioritize consumers’ privacy, and (3) remain cautious about preparing for and preventing any breach-related exposure. For the full debrief of the legal implications of the enforcement of the CCPA, click the link here: