The California attorney general recently published proposed modifications to the operative final regulations to the California Consumer Privacy Act, including notable regulatory changes requested by the attorney general for those businesses subject to the act.
A third set of proposed modifications to the California Consumer Privacy Act (CCPA) regulations were announced by the California attorney general on October 12. The announcement comes less than two months after California’s Office of Administrative Law (OAL) approved the final CCPA regulations that went into immediate effect on August 14, as we previously reported. The latest set of proposed modifications provide illustrative examples on complying with the CCPA’s opt-out rights and the submission of consumer data privacy requests from authorized agents.
If approved by the OAL, the third set of proposed CCPA regulations requested by the attorney general would require the following.
For businesses that collect personal information in person, over the phone, or through other methods not involving the internet, the proposed modifications require that notice of the right to opt out of the sale of personal information be provided through that same offline method. For instance, if a business collects personal information in a brick-and-mortar store, then the proposed modifications suggest that signage be placed at the collection point directing the consumer to the web address for the business’s privacy policy.
The proposed modifications instruct that businesses shall not use methods that are designed to impair, or have the substantial effect of impairing, a consumer’s choice to opt out of the sale of their personal information. This requires businesses to implement minimal steps from the point of request (when the consumer clicks the “Do Not Sell My Personal Information” hyperlink) to the completion of that request. Further, a business cannot require a consumer to go through more steps to opt out than are required to opt into the sale of personal information after a consumer previously opted out. The proposed modifications also caution businesses against using confusing language when providing consumers the choice to opt out and against requiring consumers to click through or listen to reasons why they should not opt out, with limited exceptions.
Under the proposed modifications, businesses may require a consumer’s authorized agent to provide proof that the consumer has given permission and may require a consumer to verify their “request to know” or “request to delete.”
The proposed modifications make clear that a business having actual knowledge that it sells the personal information of consumers under the age of 13, or between the ages of 13 and 15, must provide certain disclosures in its privacy policy about the processes it uses to obtain the affirmative opt-in consent needed to sell personal information of consumers under the age of 16. While this proposal does not change the type of consent required to sell personal information of consumers under the age of 16, it does contemplate a change in how that process is disclosed in privacy policies.
Overall, the proposed modifications to the CCPA regulations make minor, noncontroversial edits to the final CCPA regulations. The attorney general is accepting public comments to the proposed regulations until October 28, 2020. As the CCPA continues to be amended and the attorney general seeks further changes to the regulations, businesses should review the proposed changes to assess any impact on CCPA compliance obligations in deciding whether to comment.
The issuance of the third set of proposed modifications to the CCPA regulations further defines the CCPA regulatory and enforcement landscape, following the August 14 approval of the final CCPA regulations by the OAL. See Morgan Lewis Insight: CCPA Final Regulations Approved and Immediately Enforceable by the California Attorney General. With the final CCPA regulations now approved and in effect, we expect broadened attorney general enforcement activity to remedy not just alleged violations of the statute, but also alleged violations of the final regulations.
The third set of proposed modifications to the CCPA regulations clarifies a few issues regarding implementation of the law’s consumer privacy rights, but does not significantly alter the regulatory and enforcement picture.
The Morgan Lewis privacy team is providing practical privacy advice to more than 100 businesses on compliance with the CCPA, the proposed regulations, and how to ensure compliance. If you have any questions or would like more information, please contact any of the following Morgan Lewis lawyers:
San Francisco
Carla Oakley
Michelle Park Chiu
Los Angeles
Joseph Duffy
Philadelphia
Gregory Parks
Ezra Church
Kristin Hadgis
Julian Williams
New York
Martin Hirschprung
Washington, DC
Dr. Axel Spies