The California Attorney General has just issued some proposed revisions to the California Consumer Privacy Act (CCPA) regulations and our readers may be surprised by one of the proposed changes. You may recall that California’s Office of Administrative Law (OAL) had rejected some the proposed CCPA regulations during the summer, but accepted most of them. The accepted regulations became final on August 14, 2020.
The proposed regulatory changes from October 12 are available at www.oag.ca.gov/privacy/ccpa/current The proposed changes would affect four sections of the CCPA regulations, but the one most likely to affect our readers is this one:
- 999.315 (Requests to Opt-Out). The proposed regulation would add a new subsection that would require “requests to opt-out shall be easy for consumers.” More specifically, the proposed regulation would require, among other things:
- The business’s process for submitting a request to opt-out shall not require more steps than that business’s process for a consumer to opt-in to the sale of personal information after having previously opted out. The number of steps for submitting a request to opt-out is measured from when the consumer clicks on the “Do Not Sell My Personal Information” link to completion of the request. The number of steps for submitting a request to opt-in to the sale of personal information is measured from the first indication by the consumer to the business of their interest to opt-in to completion of the request.
We summarize the proposed changes to the other three sections below:
- 306 (Notice of Right to Opt-Out). With respect to consumer interactions with a business that are offline, the proposed regulation would provide examples for notice given in person (signage where the information is collected) and via phone (when the information is collected).
- 326 (Authorized Agents). The proposed changes would clarify that the business may require the agent to provide proof that the consumer provided a signed authorization to the agent to submit the request, and may require the consumer to either (1) verify the consumer’s identity; or (2) directly confirm that the consumer provided the agent with permission to file the request.
- 332 (Notice to Consumers Under 16). The proposed regulation would clarify that the business must disclose in its privacy policy that it collects information from minors if the business is subject to either 330 (children under 13) or 331 (children aged 13 to 15). The current regulations use “and,” so businesses that collect information from one group but not the other would arguably not have to make the disclosure.
The deadline for comments to the California Attorney General is Wednesday, October 28, no later than 5:00 p.m. (Pacific time).
