On March 30, 2023, the California Privacy Protection Agency (CPPA) announced that its rulemaking package to implement the California Consumer Privacy Act of 2018 (CCPA), as amended by the California Privacy Rights Act of 2020 (CPRA), was approved by the California Office of Administrative Law (OAL). 

The finalized rules contain no substantive changes to the final proposed draft of the CPRA regulations released on January 31, 2023. The first CPRA rulemaking package addresses regulations concerning data processing agreements, consumer opt-out mechanisms, mandatory recognition of opt-out preference signals, dark patterns and consumer request handling. The second set of CPRA rules will address cybersecurity audits, risk assessments and automated decision-making.

The final CPRA regulations and supporting materials will be made available on the CPPA website as soon as they are processed.