The California Privacy Protection Agency (“CPPA”) held two informational hearings on March 29, 2022 and March 30, 2022, in anticipation of its upcoming rulemaking later this year.  While the CPPA Board was present throughout the hearings, its members did not present any views as part of the program.  The speakers covered the following topics of note:

  • Opt-Out Preference Signals: Stacey Schesser (Supervising Deputy Attorney General, California Department of Justice) advocated heavily for the retention of the current California Consumer Privacy Act (“CCPA”) regulations addressing user-enabled global privacy controls.  Under the current regulations, 11 CCR § 999.315(c), a business that collects personal information from consumers online must treat user-enabled global privacy controls as a valid request to opt-out of the sale of personal information.  Schesser suggested that global privacy controls help operationalize the CCPA opt-out rights for consumers.  She also noted that the California Attorney General is currently actively enforcing the CCPA regulations on global privacy controls, and referred to the Attorney General’s published enforcement case examples that included a business that failed to process opt-out requests submitted via a browser extension that signaled the global privacy control.
  • Opt-Out of Sharing: Lisa Kim (Deputy Attorney General, California Department of Justice) suggested that the California Privacy Rights Act (“CPRA”) right to opt-out of sharing for cross-context behavioral advertising applies to real-time bidding in advertising auctions.  She suggested that businesses must give consumers the right to opt-out of these auctions.
  • Right to Know: Kim also discussed the right to know under the CCPA and CPRA.  During this discussion, she used the example of a website link with which a consumer has interacted as a “specific piece of information” under the statute.  She did not address, however, how this reading of the statute relates to the CPRA’s instruction to the CPPA in § 1798.185(a)(14) to define this term “with the goal of maximizing a consumer’s right to access relevant personal information while minimizing the delivery of information to a consumer that would not be useful to the consumer, including system log information and other technical data.”
  • Dark Patterns: Jennifer King (Privacy and Data Policy Fellow, Stanford Institute for Human-Centered Artificial Intelligence, Stanford University) referred to the use of toggle switches for CCPA Do Not Sell requests as a so-called “dark pattern.”  Notably, she also acknowledged that rules on such user interfaces are confined in the CPRA to consent interfaces.
  • Privacy Risk Assessments: Gwendal LeGrand (Head of Activity for Enforcement Support and Coordination, European Data Protection Board) described the requirements for privacy risk assessments under the General Data Protection Regulation (“GDPR”).

The CPPA next intends to hold hearings in April.  Members of the public can indicate interest in speaking at these hearings through this Stakeholder Session Request Form.  This sign-up form will remain open until two weeks before the hearings, for which dates have not yet been set.

Print:
Email this postTweet this postLike this postShare this post on LinkedIn
Photo of Lindsey Tonsager Lindsey Tonsager

Lindsey Tonsager co-chairs the firm’s global Data Privacy and Cybersecurity practice. She advises clients in their strategic and proactive engagement with the Federal Trade Commission, the U.S. Congress, the California Privacy Protection Agency, and state attorneys general on proposed changes to data protection…

Lindsey Tonsager co-chairs the firm’s global Data Privacy and Cybersecurity practice. She advises clients in their strategic and proactive engagement with the Federal Trade Commission, the U.S. Congress, the California Privacy Protection Agency, and state attorneys general on proposed changes to data protection laws, and regularly represents clients in responding to investigations and enforcement actions involving their privacy and information security practices.

Lindsey’s practice focuses on helping clients launch new products and services that implicate the laws governing the use of artificial intelligence, data processing for connected devices, biometrics, online advertising, endorsements and testimonials in advertising and social media, the collection of personal information from children and students online, e-mail marketing, disclosures of video viewing information, and new technologies.

Lindsey also assesses privacy and data security risks in complex corporate transactions where personal data is a critical asset or data processing risks are otherwise material. In light of a dynamic regulatory environment where new state, federal, and international data protection laws are always on the horizon and enforcement priorities are shifting, she focuses on designing risk-based, global privacy programs for clients that can keep pace with evolving legal requirements and efficiently leverage the clients’ existing privacy policies and practices. She conducts data protection assessments to benchmark against legal requirements and industry trends and proposes practical risk mitigation measures.

Photo of Libbie Canter Libbie Canter

Libbie Canter represents a wide variety of multinational companies on privacy, cyber security, and technology transaction issues, including helping clients with their most complex privacy challenges and the development of governance frameworks and processes to comply with global privacy laws. She routinely supports…

Libbie Canter represents a wide variety of multinational companies on privacy, cyber security, and technology transaction issues, including helping clients with their most complex privacy challenges and the development of governance frameworks and processes to comply with global privacy laws. She routinely supports clients on their efforts to launch new products and services involving emerging technologies, and she has assisted dozens of clients with their efforts to prepare for and comply with federal and state privacy laws, including the California Consumer Privacy Act and California Privacy Rights Act.

Libbie represents clients across industries, but she also has deep expertise in advising clients in highly-regulated sectors, including financial services and digital health companies. She counsels these companies — and their technology and advertising partners — on how to address legacy regulatory issues and the cutting edge issues that have emerged with industry innovations and data collaborations.

Photo of Sarah Parker Sarah Parker

Sarah Parker is an associate in the firm’s Washington Office. Her practice focuses on privacy, advertising, and consumer protection regulatory matters and government investigations.

Sarah also maintains an active pro bono practice, with a focus on criminal justice and civil rights litigation