When the California Consumer Privacy Act (CCPA) enforcement period started on August 14, 2020, many companies expected that the final regulations were in place. In what turns out to be an "October Surprise" in the privacy compliance world, the California Attorney General's office released a third set of proposed modifications to the CCPA Regulations on October 12, 2020.
Highlights of these proposed modifications include:
- Offline Notice. Companies that collect data offline must provide an offline option for "opting out" of such data collection. Examples include having a paper notice to hand to consumers or posting signage that indicates how consumers can exercise their rights.
- User Friendly Opt-Out Options. Opt-out mechanisms must be consumer friendly, and the California Attorney General provided several examples, including:
- The process to opt out cannot be more difficult than an opt-in process for the sale of personal information.
- Avoid double negatives and confusing language with opt-out processes.
- Do not make consumers provide additional personal information that is not required to facilitate a consumer data request.
- Identity Verification for Consumer Rights Requests. Companies can require an authorized agent to provide verification that they have signed permission to submit requests on behalf of the consumer.
- Notice for Consumers Ages 13-15. Companies must provide clear notice to consumers if they collect information on children 13 years and under or between the ages of 13 and 15.
Comments will be taken on these proposed modifications until Wednesday, October 28, 2020, but companies are advised to keep up-to-date on these proposed changes since they are indicative of where the California Attorney General's office is likely going to direct their focus as they evaluate potential enforcement.