As 2020 draws to a close and we approach CCPA’s first birthday, the regulations continue to remain very much in “infant” mode. On December 10, 2020, the California Attorney General released a fourth set of proposed regulations. This is the second set of proposed changes released since the regulations went into effect in August 2020. Companies have until December 28, 2020 to submit comments to the AG on the modifications.

These proposed modifications present two changes to the “do not sell” rules.

• Clarifies that only businesses that “sell” personal information collected in the course of interacting with consumers offline need to provide consumers with an offline notice of their right to opt-out. This should include instructions about how consumers can opt-out.
• Adds a “Do Not Sell My Personal Information” button that businesses may use in addition to having the link on the bottom of their website. If businesses choose to use the button, it must be located to the left of the link and must be the same size as other buttons used by businesses on the website.

Putting it into Practice. Businesses are reminded that the CCPA statute and regulations are currently in effect. This latest proposal just contains further modifications. Further, the CPRA contemplates that additional regulations will be issued. The rulemaking process for CPRA is anticipated to start sometime in 2021.