On Monday, the California Attorney General (“AG”) proposed a third set of modifications to the recently enacted California Consumer Privacy Act (“CCPA”) regulations.  Interested parties have until October 28 to file comments in response.

These proposed modifications are the latest effort in an extensive rulemaking process that has lasted more than a year.  Most recently, on August 14, the California Office of Administrative Law (“OAL”) formally approved the AG’s initial set of CCPA regulations, which went into effect immediately.  In approving the regulations, the OAL deleted five provisions that had been included in the version the AG submitted in June, but indicated that the AG could revise and resubmit those subsections for approval in the future.  The latest modifications are largely focused on reviving several of these last-minute removals.

In particular, the proposed modifications would:

  • Reinstate the offline notice requirements, which apply broadly to any “business that collects personal information in the course of interacting with consumers offline.”  The proposed modifications include illustrative examples in § 999.306(b)(3) of how businesses that collect personal information from consumers offline can provide the notice of right to opt-out of the sale of personal information through an offline method.  A brick-and-mortar store may provide notice by printing notice on paper forms that are used to collect information or posting signs that explain how to find online notice.  And a business that collects information over the phone can provide notice orally during the phone call.
  • Provide more specific guidance in § 999.315(h) on methods for submitting requests to opt-out.  The proposed modifications disfavor methods that are “designed with the purpose” or that have “the substantial effect” of “subverting or impairing a consumer’s decision to opt-out.”  For example, a business should not require a consumer to go through more steps to opt-out of selling personal information than to opt-in after having opted-out.  Businesses also should not use confusing language like double negatives.
  • Clarify in § 999.326(a) the proof that a business may require from an authorized agent submitting a request on behalf of a consumer.

The proposed regulations also modify § 999.332(a), which outlines the requirements for notice to consumers under 16 years old.  The revision clarifies that a business subject to either § 999.330 (describing the requirements for consumers under 13) or § 999.331 (governing consumers ages 13 to 15) is required to include a description of the opt-in and opt-out processes in its privacy policy.  As previously written, the regulations appeared to apply only to businesses subject to both § 999.330 and § 999.331.

These changes suggest the AG may continue to refine the rules in the coming months.

Print:
EmailTweetLikeLinkedIn
Photo of Lindsey Tonsager Lindsey Tonsager

Lindsey Tonsager helps national and multinational clients in a broad range of industries anticipate and effectively evaluate legal and reputational risks under federal and state data privacy and communications laws.

In addition to assisting clients engage strategically with the Federal Trade Commission, the…

Lindsey Tonsager helps national and multinational clients in a broad range of industries anticipate and effectively evaluate legal and reputational risks under federal and state data privacy and communications laws.

In addition to assisting clients engage strategically with the Federal Trade Commission, the U.S. Congress, and other federal and state regulators on a proactive basis, she has experience helping clients respond to informal investigations and enforcement actions, including by self-regulatory bodies such as the Digital Advertising Alliance and Children’s Advertising Review Unit.

Ms. Tonsager’s practice focuses on helping clients launch new products and services that implicate the laws governing the use of endorsements and testimonials in advertising and social media, the collection of personal information from children and students online, behavioral advertising, e-mail marketing, artificial intelligence the processing of “big data” in the Internet of Things, spectrum policy, online accessibility, compulsory copyright licensing, telecommunications and new technologies.

Ms. Tonsager also conducts privacy and data security diligence in complex corporate transactions and negotiates agreements with third-party service providers to ensure that robust protections are in place to avoid unauthorized access, use, or disclosure of customer data and other types of confidential information. She regularly assists clients in developing clear privacy disclosures and policies―including website and mobile app disclosures, terms of use, and internal social media and privacy-by-design programs.