The California attorney general recently published proposed modifications to the operative final regulations to the California Consumer Privacy Act, including notable regulatory changes requested by the attorney general for those businesses subject to the act.
A third set of proposed modifications to the California Consumer Privacy Act (CCPA) regulations were announced by the California attorney general on October 12. The announcement comes less than two months after California’s Office of Administrative Law (OAL) approved the final CCPA regulations that went into immediate effect on August 14, as we previously reported. The latest set of proposed modifications provide illustrative examples on complying with the CCPA’s opt-out rights and the submission of consumer data privacy requests from authorized agents.
If approved by the OAL, the third set of proposed CCPA regulations requested by the attorney general would require the following.
The proposed modifications instruct that businesses shall not use methods that are designed to impair, or have the substantial effect of impairing, a consumer’s choice to opt out of the sale of their personal information. This requires businesses to implement minimal steps from the point of request (when the consumer clicks the “Do Not Sell My Personal Information” hyperlink) to the completion of that request. Further, a business cannot require a consumer to go through more steps to opt out than are required to opt into the sale of personal information after a consumer previously opted out. The proposed modifications also caution businesses against using confusing language when providing consumers the choice to opt out and against requiring consumers to click through or listen to reasons why they should not opt out, with limited exceptions.
Under the proposed modifications, businesses may require a consumer’s authorized agent to provide proof that the consumer has given permission and may require a consumer to verify their “request to know” or “request to delete.”
Overall, the proposed modifications to the CCPA regulations make minor, noncontroversial edits to the final CCPA regulations. The attorney general is accepting public comments to the proposed regulations until October 28, 2020. As the CCPA continues to be amended and the attorney general seeks further changes to the regulations, businesses should review the proposed changes to assess any impact on CCPA compliance obligations in deciding whether to comment.
The issuance of the third set of proposed modifications to the CCPA regulations further defines the CCPA regulatory and enforcement landscape, following the August 14 approval of the final CCPA regulations by the OAL. See Morgan Lewis Insight: CCPA Final Regulations Approved and Immediately Enforceable by the California Attorney General. With the final CCPA regulations now approved and in effect, we expect broadened attorney general enforcement activity to remedy not just alleged violations of the statute, but also alleged violations of the final regulations.
The third set of proposed modifications to the CCPA regulations clarifies a few issues regarding implementation of the law’s consumer privacy rights, but does not significantly alter the regulatory and enforcement picture.
The Morgan Lewis privacy team is providing practical privacy advice to more than 100 businesses on compliance with the CCPA, the proposed regulations, and how to ensure compliance. If you have any questions or would like more information, please contact any of the following Morgan Lewis lawyers: