California Attorney General Xavier Becerra has announced approval of four additional regulations to the California Consumer Privacy Act (CCPA). Effective immediately, the changes focus on the right to opt-out of the sale of personal information and on authorized agent requests. Here are the four additions:
- While many of us may have seen website notices that allow a consumer to opt-out of the sale of their personal information with a click of a button, the updated regulations include examples of how a brick-and-mortar store that collects personal information offline may inform consumers of their right to opt-out directly on a paper form or during the phone call through which the information was collected.
- An opt-out icon has been included to use in addition to posting the right to opt-out notice or "Do Not Sell My Personal Information" link. The icon is required to be approximately the same size as other icons used by the business on its webpage.
- Guidance has been provided to ensure consumers can easily request to opt-out with minimal steps. This includes not using confusing language, requiring additional personal information, unnecessary multiple clicks to confirm the request, or requiring the consumer to search or scroll through text to locate directions on submitting the request to opt-out.
- Businesses may require proof that a consumer gave an authorized agent signed permission to submit an opt-out request on behalf of the consumer.
According to the Attorney General, the "newly-approved regulations ban so-called 'dark patterns' that delay or obscure the process for opting out of the sale of personal information."
Hinshaw intern Amina Jaffer contributed to the research and drafting of this alert.
