Several years into the CCPA and CPRA regime, most companies have the basics in place: a privacy policy, a cookie banner, and a process for responding to consumer requests. Enforcement activity over the past year, however, has made clear that having the paperwork is not the same as being compliant in practice. The California Privacy Protection Agency and the Attorney General's office have both signaled that they are looking past the privacy policy and into how the business actually operates. Below are the gaps we see most often.

Treating the Privacy Policy as the Compliance Program

A ...

California businesses that experience a data security incident now face a defined 30-day notification deadline under SB 446, a meaningful change from the prior standard, which required notice only “in the most expedient time possible and without unreasonable delay.” The shift from a flexible standard to a hard deadline changes how the first 72 hours of an incident response should be structured, and it raises the stakes for organizations that have not run a breach response before.

Why the Change Matters

Under the prior rule, a business had a defensible argument for taking ...