California AG Requires Businesses To Recognize GPC Signals For Requests To Opt Out Of Sales

Husch Blackwell LLP
Contact

Keypoint: Businesses that sell personal information under the CCPA are now required to honor Global Privacy Control signals.

In an update to its CCPA FAQs, the California Attorney General’s office has stated that businesses that sell personal information must honor Global Privacy Control (GPC) signals.

By way of background, § 1798.120 of the CCPA requires businesses to honor consumer requests to opt out of the sale of their personal information. To exercise this right, § 1798.135 requires such businesses to provide “a clear and conspicuous link on the business’s Internet homepage titled ‘Do Not Sell My Personal Information’ to an Internet Web page that enables a consumer, or a person authorized by the consumer, to opt-out of the sale of the consumer’s personal information.” Although § 1798.135 only requires a DNSMPI link, § 1798.185(a)(4) empowers the AG’s office to promulgate regulations to “facilitate and govern the submission of” opt out requests, and § 1798.140(i) provides the AG’s office with discretion to approve additional methods of submitting requests.

Relying on this statutory authority, the AG’s office promulgated § 999.315 of the CCPA regulations (Requests to Opt-Out), requiring businesses to provide two or more methods for submitting opt out requests. These methods include the DNSMPI link as well as a “toll-free phone number, a designated email address, a form submitted in person, a form submitted through the mail, and user-enabled global privacy controls, such as a browser plug-in or privacy setting, device setting, or other mechanism, that communicate or signal the consumer’s choice to opt-out of the sale of their personal information.”

With respect to global privacy controls, the regulations explain: “If a business collects personal information from consumers online, the business shall treat user-enabled global privacy controls, such as a browser plug-in or privacy setting, device setting, or other mechanism, that communicate or signal the consumer’s choice to opt-out of the sale of their personal information as a valid request submitted pursuant to Civil Code section 1798.120 for that browser or device, or, if known, for the consumer.”

Starting on page 47 of its Final Statement of Reasons, the AG’s office provided a lengthy explanation for why it believed it had the statutory authority to require businesses to honor user-enabled global privacy controls and how such controls would benefit consumers. However, the AG’s office recognized that this regulation was “forward-looking and intended to encourage innovation and the development of technological solutions to facilitate and govern the submission of requests to opt-out.” In other words, the AG’s office recognized that, at the time the Final Statement of Reasons was published on June 1, 2020, a viable user-enabled privacy control did not exist.

In response to the AG regulations, a coalition of various stakeholders began working on the GPC. In October 2020, then-Attorney General Becerra tweeted his support for this ongoing work. In its updated FAQs, the AG’s office has now gone one step further and stated that “the GPC is one option for consumers who want to submit requests to opt-out of the sale of their personal information via a user-enabled global privacy control. Under law, it must be honored by covered businesses as a valid consumer request to stop the sale of personal information.”

In light of the AG’s comments, businesses that sell personal information will need to analyze how to comply with GPC signals. For reference, some cookie management tools can be leveraged to do so. See, e.g., here. The GPC also has published guidance available here.

[View source.]

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Husch Blackwell LLP | Attorney Advertising

Written by:

Husch Blackwell LLP
Contact
more
less

Husch Blackwell LLP on:

Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
- hide
- hide

This website uses cookies to improve user experience, track anonymous site usage, store authorization tokens and permit sharing on social media networks. By continuing to browse this website you accept the use of cookies. Click here to read more about how we use cookies.