On October 12, 2020, less than a month before California will vote on a referendum potentially overhauling the California Consumer Privacy Act (the “CCPA”), the California Attorney General published further proposed amendments to the regulations implementing the CCPA. As may be recalled, the previous version of the regulations were submitted by the Attorney General for approval in June 2020, and subsequently were made effective on August 14, 2020. The Attorney General has now submitted a proposal (the “Third Amended Regulations”) modifying the currently-effective regulations as follows:
- First, the Third Amended Regulations clarify a business’s obligation to provide notice and a right to opt-out of a “sale” of personal information in scenarios where the business collects personal information offline. The proposed language states “A business that collects personal information in the course of interacting with consumers offline shall also provide notice by an offline method that facilitates consumers’ awareness of their right to opt-out.”1 Read literally, this amendment may require businesses to provide a separate notice of the right to opt-out of a “sale” of personal information, through signage or otherwise, even if the business also provides an opt-out method on its website.
- Second, the Third Amended Regulations also would prohibit a business from utilizing opt-out methods that are designed to, in the view of the Attorney General, inhibit or subvert the exercise of the opt-out. For example, the Third Amended Regulations suggest that forcing a consumer to scroll through a privacy policy to locate an opt-out link as part of the “Do Not Sell” opt-out process would be unduly burdensome.
- Third, the Third Amended Regulations made certain modifications to provisions governing authorized agents to allow authorized agents to provide proof of their authority to act on behalf of the consumer. The modifications also make clear that a business may require a consumer to either verify their identity with the business directly or confirm they have given the authorized agent permission.
- The fourth change makes clear that a business that is subject to sections 999.330 or 999.331 must provide certain notices to consumers under the age of 16 in the business’s privacy policy.
A copy of the proposed regulations are available here. Written comments must be submitted by no later no later than 5:00 p.m. on October 28, 2020 by email to PrivacyRegulations@doj.ca.gov, or by mail to the address listed below:
Lisa B. Kim, Privacy Regulations Coordinator
California Office of the Attorney General
300 South Spring Street, First Floor
Los Angeles, CA 90013
Email: PrivacyRegulations@doj.ca.gov
1. Proposed Regulation 999.306(b)(3).
[View source.]
