California AG Releases Fourth Set of Modifications to CCPA Regulations

Orrick - Trust Anchor

On December 10, 2020, California Attorney General Xavier Becerra (California AG) released a fourth set of proposed modifications to the California Consumer Privacy Act (CCPA) regulations that went into effect on August 14, 2020. These modifications reflect minor changes to the third set of modifications to the regulations (published on October 12, 2020).

What’s New in the Fourth Set of Modifications:

The fourth set of modifications focus on notice obligations for businesses that sell personal information that is collected offline and the re-introduction of a “Do Not Sell My Personal Information” button.

Offline Notice of Sale of Personal Information Collected Offline: The fourth set of proposed modifications clarify the third set of modification’s obligations for businesses that sell personal information collected offline. The third set of proposed modifications required businesses that collected personal information from consumers offline to provide notice of consumers right to opt-out of the sale of personal information using an offline method. The fourth set of modifications narrow this requirement to apply to businesses that sell personal information collected offline. Specifically, these businesses must provide an offline method to inform consumers of their right to opt-out of the sale of their personal information with instructions on how to submit an opt-out request.  As an example, a business that sells personal information collected in a brick-and-mortar store may inform consumers using the paper forms used to collect the personal information or, alternatively, by posting a sign in the area where the personal information is collected. If a business collects personal information over the phone, the business may orally inform consumers of their right to opt-out at the time the information is collected.

“Do Not Sell My Personal Information” Button: The proposed modifications also re-introduce a “Do Not Sell My Personal Information” button that businesses may use in addition to posting the notice of the right for consumers to opt-out of the sale of personal information. The opt-out button appeared in the California AG’s proposed regulations in February 2020 but was removed. The opt-out button must be added to the left of the text “Do Not Sell My Personal Information” and must be the same size as any other buttons used by the business on their website. The button must link to the same website or location to which the consumer is directed after clicking the “Do Not Sell My Personal Information” link.

An example of the button is below:

The fourth set of proposed modifications include a public comment period that closed at 5:00 p.m. PST on December 28, 2020. With the ever-changing regulations and the addition of the newly passed California Privacy Rights Act of 2020 (CPRA), companies should continue to evaluate their CCPA and privacy compliance programs.

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Orrick - Trust Anchor | Attorney Advertising

Written by:

Orrick - Trust Anchor
Contact
more
less

Orrick - Trust Anchor on:

Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
- hide
- hide

This website uses cookies to improve user experience, track anonymous site usage, store authorization tokens and permit sharing on social media networks. By continuing to browse this website you accept the use of cookies. Click here to read more about how we use cookies.