California Attorney General Issues Surprise Third Set of Proposed Modifications to CCPA Regulations

Akin Gump Strauss Hauer & Feld LLP

The California Attorney General surprised companies by issuing new guidance for the California Consumer Privacy Act (CCPA) compliance, reflecting likely compliance missteps by companies. On Tuesday October 12, 2020, the California Office of the Attorney General (OAG) released proposed modifications to the currently effective CCPA Regulations (“Regulations”). The OAG first published the proposed regulations on October 11, 2019 and proposed subsequent modifications on February 10, 2020 and March 11, 2020. The California Office of Administrative Law approved the Regulations on August 14, 2020. Please review our previous posts on the Regulations [A Business Guide to the Draft CCPA Regulations – October 28, 2019;  Understanding What the Revised Draft CCPA Regulations Mean for Business – February 20, 2020; California Approves Final California Consumer Privacy Act Regulations – August 10, 2020.]

In announcing the proposed modifications, the OAG release a notice, available here and a comparative text of the proposed modifications, available here.

The proposed modifications include four key changes to the Regulations, which are summarized below.

Offline Opt-Out. § 999.306 was revised to include a new subsection (b)(3), which specifies that businesses collecting personal information “in the course of interacting with consumers’ offline” must also provide an opt-out notice by an offline method that “facilitates the consumers’ awareness of their right to opt out.” The proposed modifications also include two illustrative examples, including the option for brick-and-mortar stores to print the notice on the paper forms that collect personal information or by posting signage in the area where the personal information is collected directing consumers to where the notice can be found online. Additionally, a business that collects personal information over the phone can provide the opt-out notice orally during the call where personal information is collected.

Methods for Submitting Requests to Opt-Out. § 999.315 was revised to include a new subsection (h) that sets forth guidance on how a business should provide methods for consumers to submit requests to opt-out. The proposed modifications require that a business’s “methods for submitting requests to opt-out shall be easy for consumers to execute and shall require minimal steps to allow the consumer to opt-out” and that “a business shall not use a method that is designed with the purpose or has the substantial effect of subverting or impairing a consumer’s choice to opt-out.” According to the notice, the proposed modifications include illustrative examples of methods designed with the purpose or substantial effect of subverting or imparting a consumer’s choice to opt-out. The examples in the proposed modifications include:

  • The business’s process for submitting a request to opt-out shall not require more steps than that business’s process for a consumer to opt-in to the sale of personal information after having previously opted out. The modifications specify that that the number of steps for submitting a request to opt-out is measured from when the consumer clicks on the opt-out link to the completion of an opt-out request while the number of steps for submitting a request to opt-in is measured from the first indication by the consumer to the business of their interest to opt-in to completion of the request.
  • A business shall not use confusing language, such as double negatives (e.g., “Don’t Not Sell My Personal Information”), when providing consumers the choice to opt-out.
  • A business shall not require consumers to click through or listen to reasons why they should not submit a request to opt-out before confirming their request (except as permitted by the Regulations).
  • The process for submitting a request to opt-out shall not require the consumer to provide personal information that is not necessary to implement the request.
  • Upon clicking the “Do Not Sell My Personal Information” link, a business shall not require the consumer to search or scroll through the text of a privacy policy or similar document or webpage to locate the mechanism for submitting a request to opt-out.

Authorized Agent Authority. § 999.326(a) was modified to clarify that a business may require that a consumer’s authorized agent provide proof that the consumer gave the agent signed permission to submit a request to know or a request to delete.

Notices to Consumers Under 16. § 999.332 was modified to clarify that a business that collects information of consumers under 13 years old and/or consumers between the ages of 13 and 15 must include a description of the process set forth in § 999.330 and § 999.331 in its privacy policy.

The OAG will accept written comments on the proposed modifications until 5:00 pm PST on October 28, 2020.

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Akin Gump Strauss Hauer & Feld LLP | Attorney Advertising

Written by:

Akin Gump Strauss Hauer & Feld LLP

Akin Gump Strauss Hauer & Feld LLP on:

Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
- hide
- hide

This website uses cookies to improve user experience, track anonymous site usage, store authorization tokens and permit sharing on social media networks. By continuing to browse this website you accept the use of cookies. Click here to read more about how we use cookies.