On March 30, 2023, the California Privacy Protection Agency (CPPA) announced that California’s Office of Administrative Law (“OAL”) approved the CPPA’s substantive rulemaking package to implement the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (CPRA). The finalized rules contain no substantive changes to the rulemaking package approved by the CPPA in February 2023. Some of the most significant topics addressed in the new regulation include a new framework for the lawful use of consumer data, guidance on when and how consent must be obtained from consumers, and a new opt-out framework.

...