July 20, 2023

CA Attorney General Announces CCPA Investigative Sweep

California Attorney General Rob Bona announced earlier this week that his office has initiated an investigative sweep – through inquiry letters sent to large California employers – requesting information on businesses compliance efforts under the California Consumer Privacy Act of 2018 (CCPA). According to the Attorney General’s office, the inquiry letters are being sent as a means of “learn[ing] how employers are complying with their legal obligations” under the CCPA.

The Attorney General’s announcement concerning investigative efforts came just weeks after a last-minute ruling, by a County of Sacramento Superior Court stayed enforcement of CCPA and California Privacy Rights Act (CPRA) regulations until March 29, 2024.

The CCPA gives consumers more control over the personal information businesses collect about them. Effective January 1, 2023, California businesses subject to the CCPA must not only comply with existing CCPA privacy requirements (e.g., providing notice of privacy practices, fulfilling consumer requests to exercise their rights to access, delete, and opt out of the sale and sharing of personal information) but also privacy protections associated with employee data under the California Privacy Rights Act (CPRA).[i]

Although CCPA enforcement efforts are stayed until March 29, 2024, employers subject to the CCPA/CPRA should continue bolstering compliance efforts especially around employee-related data.

For additional information on CCPA/CPRA compliance:


[i] In November 2020, California voters passed Proposition 24, the California Privacy Rights Act (CPRA), which amends the CCPA by extending data privacy protections to employee data (employee data includes data associated with applicants and job candidates).