On February 7, 2020, California Attorney General Xavier Becerra (the California AG) proposed revisions to the regulations implementing the California Consumer Privacy Act (CCPA) that his office had first proposed on October 10, 2019. The California AG released a further revised version of the regulations a few days later on February 10 due to an inadvertent omission. Along with the new proposed regulations, the California AG also released documentation that his office relied on in reaching the revisions. Comments are due by February 25, and it is not clear when the California Attorney General’s Office will release final CCPA regulations, as the enforcement deadline looms on July 1, a mere 18 weeks from now. Meanwhile, the advertising industry has formally requested a delay in the enforcement date given that the new regulations are still not final.
The new proposed regulations purport to clarify ambiguities from the previous version of the regulations and to address unanswered questions in the CCPA itself. Like the previous version of the regulations, the new version of the regulations also imposes additional obligations on businesses that are not found in the text of the CCPA itself. Below is a list of the major highlights of the new proposed regulations:
The rest of this client alert identifies key takeaways from each of the six substantive Articles by which the regulations are organized.
For background on the CCPA and our assessment of the previous version of the draft regulations, please read our client alert on the prior version of the California AG’s proposed CCPA regulations.
Article 1: General Provisions (Including Definitions)
Article 2: Notice to Consumers
Article 3: Responding to Requests to Know and Requests to Delete
Article 4: Verification of Requests
Article 5: Special Rules Regarding Minors
Regarding authorization for minors under the age of 13, the new proposed regulations require businesses to “establish, document, and comply with a reasonable method . . . for determining whether a person submitting a request to know or a request to delete the personal information of a child under the age of 13 is the parent or guardian of that child.” 11 CCR § 999.330(c).
Article 6: Non-Discrimination