The California Privacy Protection Agency (“CPPA”) held two public hearings last week on its proposed regulations.

Here are some key takeaways:

  • Enforcement date debate. Multiple commenters requested that the CPPA delay the enforcement date by at least one year after the regulations are finalized, i.e. January 1st, 2024 or later. However, other speakers pushed back on this request.
  • Estimates of regulatory costs. At both hearings, commenters expressed concern that the CPPA’s estimates of regulatory costs to businesses were not realistic.
  • Global opt-out preference signals. Commenters also addressed the draft regulations’ mandate that businesses honor global opt-out preference signals. Some supported the mandate, while others emphasized that the mandate is inconsistent with the CPRA’s statutory text. See, e.g., CPRA § 1798.135(b)(3) (providing that “a business may elect whether to” post links or comply with opt-out preference signals). Others called for more clarity from the CPPA on the issue, such as by compiling a registry of global opt-out preference signals that businesses are required to honor.
  • Sensitive personal information. The second hearing heard comments endorsing the restricted use and disclosure of sensitive information, emphasizing the importance of the CPRA’s data minimization standards.
  • Dark patterns. Finally, some commenters supported the regulations’ language on dark patterns.
Print:
Email this postTweet this postLike this postShare this post on LinkedIn
Photo of Lindsey Tonsager Lindsey Tonsager

Lindsey Tonsager co-chairs the firm’s global Data Privacy and Cybersecurity practice. She advises clients in their strategic and proactive engagement with the Federal Trade Commission, the U.S. Congress, the California Privacy Protection Agency, and state attorneys general on proposed changes to data protection…

Lindsey Tonsager co-chairs the firm’s global Data Privacy and Cybersecurity practice. She advises clients in their strategic and proactive engagement with the Federal Trade Commission, the U.S. Congress, the California Privacy Protection Agency, and state attorneys general on proposed changes to data protection laws, and regularly represents clients in responding to investigations and enforcement actions involving their privacy and information security practices.

Lindsey’s practice focuses on helping clients launch new products and services that implicate the laws governing the use of artificial intelligence, data processing for connected devices, biometrics, online advertising, endorsements and testimonials in advertising and social media, the collection of personal information from children and students online, e-mail marketing, disclosures of video viewing information, and new technologies.

Lindsey also assesses privacy and data security risks in complex corporate transactions where personal data is a critical asset or data processing risks are otherwise material. In light of a dynamic regulatory environment where new state, federal, and international data protection laws are always on the horizon and enforcement priorities are shifting, she focuses on designing risk-based, global privacy programs for clients that can keep pace with evolving legal requirements and efficiently leverage the clients’ existing privacy policies and practices. She conducts data protection assessments to benchmark against legal requirements and industry trends and proposes practical risk mitigation measures.

Photo of Libbie Canter Libbie Canter

Libbie Canter represents a wide variety of multinational companies on privacy, cyber security, and technology transaction issues, including helping clients with their most complex privacy challenges and the development of governance frameworks and processes to comply with global privacy laws. She routinely supports…

Libbie Canter represents a wide variety of multinational companies on privacy, cyber security, and technology transaction issues, including helping clients with their most complex privacy challenges and the development of governance frameworks and processes to comply with global privacy laws. She routinely supports clients on their efforts to launch new products and services involving emerging technologies, and she has assisted dozens of clients with their efforts to prepare for and comply with federal and state privacy laws, including the California Consumer Privacy Act and California Privacy Rights Act.

Libbie represents clients across industries, but she also has deep expertise in advising clients in highly-regulated sectors, including financial services and digital health companies. She counsels these companies — and their technology and advertising partners — on how to address legacy regulatory issues and the cutting edge issues that have emerged with industry innovations and data collaborations.

Photo of Natalie Dugan Natalie Dugan

Natalie Dugan is an associate in the firm’s Washington, DC office and a member of the Data Privacy and Cybersecurity Practice Group as well as the International Trade Practice Group.

Natalie advises clients on a broad range of privacy and cybersecurity issues, including…

Natalie Dugan is an associate in the firm’s Washington, DC office and a member of the Data Privacy and Cybersecurity Practice Group as well as the International Trade Practice Group.

Natalie advises clients on a broad range of privacy and cybersecurity issues, including on topics related to privacy policies and data practices, responses to regulatory inquiries, and compliance obligations under U.S. state privacy regulations like the California Consumer Privacy Act. Her practice also includes helping clients navigate international trade policy and customs matters.

Photo of Miranda Rutherford Miranda Rutherford

Miranda Rutherford is an associate in the firm’s Palo Alto office whose practice focuses on data privacy, cybersecurity, and electronic surveillance matters. Miranda advises clients on compliance with federal and state privacy and surveillance laws, including when clients are updating external and internal…

Miranda Rutherford is an associate in the firm’s Palo Alto office whose practice focuses on data privacy, cybersecurity, and electronic surveillance matters. Miranda advises clients on compliance with federal and state privacy and surveillance laws, including when clients are updating external and internal privacy policies, developing new products, and responding to law enforcement data requests.

Prior to joining the firm, Miranda was a law clerk to the Honorable James Donato, United States District Judge for the Northern District of California.

Photo of Sarah Parker Sarah Parker

Sarah Parker is an associate in the firm’s Washington Office. Her practice focuses on privacy, advertising, and consumer protection regulatory matters and government investigations.

Sarah also maintains an active pro bono practice, with a focus on criminal justice and civil rights litigation