California Attorney General Issues Further Revisions to CCPA Opt-Out Requirements

Wiley Rein LLP

[co-author: Tawanna Lee]

On March 15, 2021, the California Attorney General (AG) issued further amendments to the implementing regulations of the California Consumer Privacy Act (CCPA), clarifying how a business must facilitate a consumer’s exercise of their right to opt-out of the sale of their personal information. These amendments take effect immediately.

The amendments come as the state prepares to conduct new rounds of rulemaking to implement the recently-passed California Privacy Rights Act (CPRA).

Below we summarize the latest amendments to the CCPA regulations.

The Latest Amendments

The March 15 amendments affirmatively prohibit a business from making the process to opt-out of the sale of a consumer’s information burdensome or confusing. Specifically, the revised regulation requires that the opt-out process require only minimal steps. The amendment prohibits:

  • An opt-out process that includes more steps than required to opt-in to the sale of personal information (after having previously opted-out);
  • The use of confusing language, such as a double negative “Don’t Not Sell My Personal Information;”
  • Requiring a consumer to click through or listen to reasons why they should NOT opt-out, except as otherwise allowed by the CCPA;
  • Requiring the consumer to scroll through the text of the privacy policy or other webpage or document to locate the opt-out link.

The amendments also offer an optional icon for use in addition to posting the notice of right to opt-out or the “Do Not Sell My Personal Information” link. The icon can be downloaded here.

Further, specific examples are provided to explain how a business that collects information from consumers offline (such as in a store or over the phone) can ensure the consumer knows how to exercise their opt-out right. These examples include by providing prominent notice at the point of collection, such as printing the notice on a paper form or including a sign in the area of the store where information is collected. Where information is collected over the phone, the regulations require that a business inform the consumer orally how they may opt-out from the sale of their information.

Finally, in addition to the revisions related to opt-out, this latest round of revisions amends the provisions detailing how a business may authenticate authorized agent requests to know or to delete information.


As states continue to move forward on privacy laws—including California’s new rulemaking efforts to implement the CPRA and the passage of an omnibus privacy law in Virginia just weeks ago—it is crucial that businesses keep their fingers on the pulse of emerging privacy laws in the United States.

Written by:

Wiley Rein LLP

Wiley Rein LLP on:

Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
- hide
- hide

This website uses cookies to improve user experience, track anonymous site usage, store authorization tokens and permit sharing on social media networks. By continuing to browse this website you accept the use of cookies. Click here to read more about how we use cookies.