On August 14, 2020, the final regulations for the California Consumer Privacy Act (CCPA) (available here) were approved by the California Office of Administrative Law (OAL) and are effective immediately. The CCPA has technically been in effect since January 1, 2020, and enforcement began July 1, 2020. The final regulations largely match the final proposed regulations that California Attorney General Xavier Becerra submitted to the OAL in June.

An Addendum to the Final Statement of Reasons (available here) identifies specific changes from the final proposed regulations. Most of these changes are non-substantive, such as grammatical fixes. One notable change is that the AG removed the abbreviated “Do Not Sell My Info” language. Therefore, a business must use the full “Do Not Sell My Personal Information” language in the opt-out request link on its website. Also, the AG withdrew the following provisions:

• § 999.305(a)(5) – requiring a business to notify and obtain explicit consent from a consumer when the business seeks to use that consumer’s personal information for a purpose materially different than what was previously disclosed to the consumer in the notice at collection.

• § 999.306(b)(2) – requiring a business that substantially interacts with consumers offline to notify consumers via an offline method of their right to opt-out.

• § 999.315(c) – stating that a business’s methods for submitting opt-out requests must be easy and require minimal steps. (However, a business still must consider the ease of use when determining methods for submitting opt-out requests.)

• § 999.326(c) – stating that a business may deny a request from an authorized agent that does not include an authorization from the consumer.

The Addendum does not specify why the AG withdrew these provisions but notes that the AG “may resubmit [the withdrawn] section[s] after further review and possible revision.” It is possible that these withdrawals are due to the AG carving back in response to challenges to its rulemaking and enforcement powers, or they may simply be in response to comments submitted to the AG.

Now that the final regulations are in effect, businesses must focus on complying with both the regulatory and statutory aspects of the CCPA. For information on how to comply with the CCPA, see Troutman Pepper’s ongoing article series on CCPA enforcement available here. Also, for information regarding the upcoming “CCPA 2.0” that is set to appear on the California November 2020 ballot, see Troutman Pepper’s article here.