The CCPA Regulations Have Been Approved and Are Effective Immediately

Troutman Pepper
Contact

Troutman Pepper

On August 14, 2020, the final regulations for the California Consumer Privacy Act (CCPA) (available here) were approved by the California Office of Administrative Law (OAL) and are effective immediately. The CCPA has technically been in effect since January 1, 2020, and enforcement began July 1, 2020. The final regulations largely match the final proposed regulations that California Attorney General Xavier Becerra submitted to the OAL in June.

An Addendum to the Final Statement of Reasons (available here) identifies specific changes from the final proposed regulations. Most of these changes are non-substantive, such as grammatical fixes. One notable change is that the AG removed the abbreviated “Do Not Sell My Info” language. Therefore, a business must use the full “Do Not Sell My Personal Information” language in the opt-out request link on its website. Also, the AG withdrew the following provisions:

  • § 999.305(a)(5) – requiring a business to notify and obtain explicit consent from a consumer when the business seeks to use that consumer’s personal information for a purpose materially different than what was previously disclosed to the consumer in the notice at collection.

  • § 999.306(b)(2) – requiring a business that substantially interacts with consumers offline to notify consumers via an offline method of their right to opt-out.

  • § 999.315(c) – stating that a business’s methods for submitting opt-out requests must be easy and require minimal steps. (However, a business still must consider the ease of use when determining methods for submitting opt-out requests.)

  • § 999.326(c) – stating that a business may deny a request from an authorized agent that does not include an authorization from the consumer.

The Addendum does not specify why the AG withdrew these provisions but notes that the AG “may resubmit [the withdrawn] section[s] after further review and possible revision.” It is possible that these withdrawals are due to the AG carving back in response to challenges to its rulemaking and enforcement powers, or they may simply be in response to comments submitted to the AG.

Now that the final regulations are in effect, businesses must focus on complying with both the regulatory and statutory aspects of the CCPA. For information on how to comply with the CCPA, see Troutman Pepper’s ongoing article series on CCPA enforcement available here. Also, for information regarding the upcoming “CCPA 2.0” that is set to appear on the California November 2020 ballot, see Troutman Pepper’s article here.

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Troutman Pepper | Attorney Advertising

Written by:

Troutman Pepper
Contact
more
less

Troutman Pepper on:

Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
- hide
- hide

This website uses cookies to improve user experience, track anonymous site usage, store authorization tokens and permit sharing on social media networks. By continuing to browse this website you accept the use of cookies. Click here to read more about how we use cookies.