Yesterday, the California Attorney General (“AG”) proposed a fourth set of modifications to the California Consumer Privacy Act regulations. These modifications build on the third set of proposed regulations released by the AG in October, which we discussed here. Interested parties have until December 28 to submit comments in response.

The proposed modifications are the most recent chapter in a lengthy rulemaking process, in which we have seen significant variation over the mechanics of implementing the CCPA. The most recent proposed changes include:

  • Requiring businesses that sell personal information collected offline to inform consumers through an offline method of their right to opt out and instructions for exercising that right.
  • Creating an opt-out button, which may be used in addition to posting the notice of the right to opt out but not in lieu of that notice or a “Do Not Sell My Personal Information” link. If a business posts the “Do Not Sell My Personal Information” link and chooses to post the button as well, the opt-out button must appear to the left of the link (example below) and must link to the location to which the consumer is directed after clicking on the link.

  • Requiring a business’s methods for submitting requests to opt-out to be easy for consumers to execute and require minimal steps, and prohibiting businesses from using a method that is either designed with the purpose or has the substantial effect of subverting or impairing a consumer’s opt-out choice. The regulations contain examples of such prohibited methods.
  • Clarifying what businesses may require of authorized agents who are acting on behalf of consumers and of consumers who are choosing to use authorized agents.
  • Explaining that a business that is subject to either the regulations governing consumers under 13 years of age or those governing consumers between the ages of 13-15 must provide a description of its opt-in process in its privacy policy.

Notably, California will continue to engage in rulemaking procedures next year. The recently passed California Privacy Rights Act (also known as proposition 24) requires an extensive rulemaking process to address a number of topics, including the notices required by the act, the use of dark patterns in the context of consumers’ opt-out rights, and an authorized agent’s ability to exercise a consumer’s rights.

Print:
Email this postTweet this postLike this postShare this post on LinkedIn
Photo of Lindsey Tonsager Lindsey Tonsager

Lindsey Tonsager co-chairs the firm’s global Data Privacy and Cybersecurity practice. She advises clients in their strategic and proactive engagement with the Federal Trade Commission, the U.S. Congress, the California Privacy Protection Agency, and state attorneys general on proposed changes to data protection…

Lindsey Tonsager co-chairs the firm’s global Data Privacy and Cybersecurity practice. She advises clients in their strategic and proactive engagement with the Federal Trade Commission, the U.S. Congress, the California Privacy Protection Agency, and state attorneys general on proposed changes to data protection laws, and regularly represents clients in responding to investigations and enforcement actions involving their privacy and information security practices.

Lindsey’s practice focuses on helping clients launch new products and services that implicate the laws governing the use of artificial intelligence, data processing for connected devices, biometrics, online advertising, endorsements and testimonials in advertising and social media, the collection of personal information from children and students online, e-mail marketing, disclosures of video viewing information, and new technologies.

Lindsey also assesses privacy and data security risks in complex corporate transactions where personal data is a critical asset or data processing risks are otherwise material. In light of a dynamic regulatory environment where new state, federal, and international data protection laws are always on the horizon and enforcement priorities are shifting, she focuses on designing risk-based, global privacy programs for clients that can keep pace with evolving legal requirements and efficiently leverage the clients’ existing privacy policies and practices. She conducts data protection assessments to benchmark against legal requirements and industry trends and proposes practical risk mitigation measures.

Photo of Libbie Canter Libbie Canter

Libbie Canter represents a wide variety of multinational companies on managing privacy, cyber security, and artificial intelligence risks, including helping clients with their most complex privacy challenges and the development of governance frameworks and processes to comply with U.S. and global privacy laws.

Libbie Canter represents a wide variety of multinational companies on managing privacy, cyber security, and artificial intelligence risks, including helping clients with their most complex privacy challenges and the development of governance frameworks and processes to comply with U.S. and global privacy laws. She routinely supports clients on their efforts to launch new products and services involving emerging technologies, and she has assisted dozens of clients with their efforts to prepare for and comply with federal and state laws, including the California Consumer Privacy Act, the Colorado AI Act, and other state laws. As part of her practice, she also regularly represents clients in strategic transactions involving personal data, cybersecurity, and artificial intelligence risk and represents clients in enforcement and litigation postures.

Libbie represents clients across industries, but she also has deep expertise in advising clients in highly-regulated sectors, including financial services and digital health companies. She counsels these companies — and their technology and advertising partners — on how to address legacy regulatory issues and the cutting edge issues that have emerged with industry innovations and data collaborations. 

Chambers USA 2024 ranks Libbie in Band 3 Nationwide for both Privacy & Data Security: Privacy and Privacy & Data Security: Healthcare. Chambers USA notes, Libbie is “incredibly sharp and really thorough. She can do the nitty-gritty, in-the-weeds legal work incredibly well but she also can think of a bigger-picture business context and help to think through practical solutions.”