California's AG outlines the challenges his office will face in enforcing the California privacy law, says he might not have enough staff to carry out the job
The state's attorney general wants to avoid a troubled rollout, à la Obamacare, when the far-reaching restrictions on user data go into effect on Jan. 1.
Context & Ripple Effects
California's privacy law exists because lawmakers raced the clock: as the ballot-deadline coverage showed, a stronger version was headed for the November ballot unless legislators passed their own bill first. That haste left unresolved questions that privacy advocates warned could be exploited by industry lobbying seeking weaker revisions.
Against that backdrop, the attorney general's staffing warning lands as a second vulnerability layered on the first — the same office that must issue draft compliance rules may not have the personnel to police the law once it takes effect January 1.
First-order effects
- Businesses face the January 1 compliance deadline knowing the AG's office may lack staff to investigate violations, which lowers near-term enforcement risk even as the rules themselves remain unsettled.
- The AG's office must stretch a finite team across rulemaking and enforcement preparation simultaneously, forcing triage over which violations get attention first.
Second-order effects
- An under-resourced enforcer strengthens the hand of industry groups pushing legislative revisions, since advocates' fear of watered-down amendments becomes easier to act on when oversight looks thin.
- Companies will lean on trade associations' shared compliance tooling to fill the guidance gap — a shortcut the AG later signaled is insufficient when he indicated blanket opt-out mechanisms don't satisfy CCPA-specific requirements.
Third-order effects
- If the pattern holds, enforcement arrives late and selectively rather than systematically — consistent with the arc that ended with the $1.2M Sephora settlement as the law's first announced penalty years after the effective date.
- A capacity-constrained AG's office makes private litigation and high-profile settlements the de facto enforcement mechanism, structuring how California privacy law actually disciplines the market regardless of what the statute promises.
The trend: State privacy regimes are being written faster than the agencies tasked with enforcing them can staff up, shifting real-world enforcement toward delayed, case-by-case actions instead of routine oversight.