On October 12, 2020, the California Department of Justice (“Department”) released its first set of proposed post-finalization modifications to the California Consumer Privacy Act Regulations (the “CCPA Regulations”).
As many businesses know, the CCPA Regulations were finalized on August 14, 2020. The Department styled these new modifications as a “Third Set of Proposed Modifications” to the CCPA Regulations, suggesting that it sees them as related to the two rounds of modifications it proposed before the Regulations were finalized. (You can read our summaries of the key impacts of these prior modifications here (first round of modification) and here (second round of modifications)).
While the Department’s new proposed modifications are modest in volume, they contain potentially significant impacts for businesses. If passed in their current form, the modifications would modify the CCPA Regulations as follows:
(1) Required Offline Opt-Out Notices Would Return: Pre-finalization drafts of the Regulations required businesses that “substantially interact with consumers offline” to provide an offline notice to consumers about their right to opt-out of data sales. However, this requirement was deleted as the Regulations were finalized during review by California’s Office of Administrative Law.
(2) The Requirement for “Easy” Opt-Outs Would Return – with Specified Prohibited Practices: Pre-finalization draft of the Regulations required businesses’ methods enabling consumer to make Opt-Out requests to be “easy for consumers to execute and  require minimal steps.” Again, however, this requirement was deleted as the Regulations were finalized during review by California’s Office of Administrative Law.
(3) Businesses Could Ask Authorized Agents for Proof of their Authority (and Would Not Need to Go to the Consumer): The new proposed modifications would clarify that, when businesses receive a CCPA request from an individual purporting to act as a consumer’s authorized agent, they can require the authorized agent to provide proof it has written permission to act for the consumer. Under the current Regulations, businesses would have to go to the consumer to obtain this proof.
A redline showing the proposed changes based on the currently effective regulations is available here. The proposed modifications are open for public comment until Wednesday, October 28, 2020.