The 2018 California Consumer Privacy Act (CCPA) requires the California Attorney General’s Office (AGO) to promulgate regulations related to the CCPA by July 1, 2020. The AGO is holding a series of six public forums and accepting written comments regarding its CCPA rulemaking. The AGO held its first public forum in San Francisco on January 8, 2019. The following is a high-level overview of points of interest:

• A panel of AGO staff received public comments. The AGO staff did not directly respond to comments or provide additional information regarding the AGO rulemaking process.
• Nearly 200 people attended the forum, although fewer than 20 people spoke. Contrary to expectations, there was not a significant activist presence. The short notice regarding the timing of the forum and post-holiday schedules may have contributed.
• The following points of interest, among others, were raised by speakers at the forum:
  • Speakers from both a business and consumer standpoint highlighted the need to identify a relevant standard of care with regard to businesses’ conduct.
  • Speakers from both a business and consumer standpoint commented on the definition of personal information, recommending respectively that the definition be limited in various ways (removal of IP addresses, etc.) or that it remain as is.
  • Multiple speakers noted the adverse effect that the CCPA may have on businesses that support themselves through advertising. Speakers recommended that businesses be able to charge a reasonable fee to consumers who elect to use their services, but choose to opt out of the sale of their data.
  • Industry advocates raised concerns that the CCPA may incentivize or require companies to collect or retain more information on consumers than they would otherwise in order to comply with consumer requests. There was also concern that the CCPA could be interpreted to require companies to link currently anonymized data to specific consumers in order to respond to consumer requests.
  • Industry advocates suggested that loyalty programs be explicitly exempted from certain provisions of the CCPA.
  • Industry advocates recommended that businesses be required to post the “Do Not Sell My Information” button on their homepages only to balance the burden.
  • Attorney commentators noted the importance of establishing safe harbors for companies that seek to comply with the CCPA, including companies that comply with consumer requests.
  • Attorney commentators recommended aligning the CCPA’s regulatory regime with existing regimes, including the European Union’s General Data Protection Regulation, to facilitate compliance.
• The AGO will hold additional public forums over the coming weeks. Information on those forums is available at this link.
• Industry advocates and activists continue to push for revisions to the CCPA in Sacramento even as the AGO pushes forward on its rulemaking mandate. At this time, we understand that bills aimed at exempting loyalty programs and permitting targeted advertising will be submitted this session.