Will CCPA Regulation Change Again?: Comment Deadline Looming

Sheppard Mullin Richter & Hampton LLP

Sheppard Mullin Richter & Hampton LLP

The California Attorney General recently released a third set of proposed modifications to the CCPA regulations. As we previously covered, the CCPA regulations were approved and went into effect on August 14, 2020. Many companies will likely be frustrated by the fact that new changes have been proposed again, just two months after the final version was approved. Companies have until October 28, 2020 to submit comments to the AG on the modifications.

Generally, the proposed modifications provide additional detail to the requirements for those companies selling information. They also address requirements related to the use of authorized agents for identity verification. The proposed modifications are summarized here, and seem to center on areas of confusion for many companies:

  • 999.306(b)(3) (Notice of Right to Opt-Out). Provides examples of how businesses that collect personal information from consumers offline can provide the notice of right to opt-out of the sale of personal information through an offline method. Specifically, brick-and-mortar stores may choose to print the notice on the paper forms that collect the personal information. They could also post signage in the area where the personal information is collected, directing consumers to where the notice can be found online.
  • 999.315(h) (Requests to Opt-Out). Provides guidance on how a company’s methods for submitting requests to opt-out should be easy and require minimal steps. It includes some examples of methods that would have a “substantial effect of subverting or impairing a consumer’s choice to opt-out.” For example, a process that requires consumers to click through or listen to reasons why they should not submit a request to opt-out before confirming their choice. Or, if clicking on the “Do Not Sell My Personal Information” leads consumers to a page that requires them to scroll through a privacy policy or other webpage to find the mechanism for opting out.
  • 999.326(a) (Authorized Agents). Clarifies the proof a business may require from an authorized agent to verify a request, as well from a consumer.
  • 999.332(a) (Notice to Consumers Under 16). Clarifies that businesses subject to either section 999.330 (those selling information of consumers under 13), section 999.331 (those selling information of consumers 13 through 15) or both of these sections, must include a description of the processes in those sections in their privacy policies.

Putting it Into Practice. The timing of these proposed changes could suggest areas where the AG is focusing from an enforcement perspective. Companies have until October 28 to submit comments, which the AG has asked be confined only to these proposed changes.

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Sheppard Mullin Richter & Hampton LLP | Attorney Advertising

Written by:

Sheppard Mullin Richter & Hampton LLP

Sheppard Mullin Richter & Hampton LLP on:

Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
- hide
- hide

This website uses cookies to improve user experience, track anonymous site usage, store authorization tokens and permit sharing on social media networks. By continuing to browse this website you accept the use of cookies. Click here to read more about how we use cookies.