The California Attorney General recently released a third set of proposed modifications to the CCPA regulations. As we previously covered, the CCPA regulations were approved and went into effect on August 14, 2020. Many companies will likely be frustrated by the fact that new changes have been proposed again, just two months after the final version was approved. Companies have until October 28, 2020 to submit comments to the AG on the modifications.
Generally, the proposed modifications provide additional detail to the requirements for those companies selling information. They also address requirements related to the use of authorized agents for identity verification. The proposed modifications are summarized here, and seem to center on areas of confusion for many companies:
- 999.306(b)(3) (Notice of Right to Opt-Out). Provides examples of how businesses that collect personal information from consumers offline can provide the notice of right to opt-out of the sale of personal information through an offline method. Specifically, brick-and-mortar stores may choose to print the notice on the paper forms that collect the personal information. They could also post signage in the area where the personal information is collected, directing consumers to where the notice can be found online.
- 999.315(h) (Requests to Opt-Out). Provides guidance on how a company’s methods for submitting requests to opt-out should be easy and require minimal steps. It includes some examples of methods that would have a “substantial effect of subverting or impairing a consumer’s choice to opt-out.” For example, a process that requires consumers to click through or listen to reasons why they should not submit a request to opt-out before confirming their choice. Or, if clicking on the “Do Not Sell My Personal Information” leads consumers to a page that requires them to scroll through a privacy policy or other webpage to find the mechanism for opting out.
- 999.326(a) (Authorized Agents). Clarifies the proof a business may require from an authorized agent to verify a request, as well from a consumer.
- 999.332(a) (Notice to Consumers Under 16). Clarifies that businesses subject to either section 999.330 (those selling information of consumers under 13), section 999.331 (those selling information of consumers 13 through 15) or both of these sections, must include a description of the processes in those sections in their privacy policies.
Putting it Into Practice. The timing of these proposed changes could suggest areas where the AG is focusing from an enforcement perspective. Companies have until October 28 to submit comments, which the AG has asked be confined only to these proposed changes.