On October 12, 2020, the California Department of Justice released a third set of proposed modifications to the California Consumer Privacy Act (“CCPA”) regulations. The CCPA regulations had been approved by the California Office of Administrative Law (“OAL”) and made effective on August 14, 2020. This third set of modifications provides additional clarification on: 1) CCPA opt-out methods; 2) authorized agent requests; and 3) privacy policy disclosures of businesses selling the personal information of consumers under sixteen (16) years of age. Please note that the California Department of Justice will accept written comments on the proposed changes until Wednesday, October 28, 2020, at 5:00 P.M.
What are the details of the proposed modifications?
CCPA Opt-Out Modifications
Some of the proposed CCPA opt-out modifications concern companies that interact with consumers offline. Previously, the CCPA had required businesses that collect personal information while interacting with consumers offline to provide consumers with an offline notice of their right to opt-out. The proposed regulations now include illustrative examples of how offline opt-out notices should be provided: 1) brick-and-mortar stores should provide notice on any paper forms that collect personal information or provide signage which informs consumers as to where they can find notice online; and 2) where businesses collect personal information over the phone, they must provide notice orally during the subject phone call. Additionally, the proposed modifications would implement standards that would make it easy and manageable for consumers to execute CCPA opt-out requests. Specifically, the modifications would mandate that: 1) the process for submitting requests to opt-out not require more steps than the process to opt-in to the sale of personal information (after having previously opted out); 2) businesses not use confusing language when providing consumers the choice to opt-out; 3) businesses not require consumers to click through or listen to reasons as to why they should not request to opt-out; 4) businesses not require consumers to provide additional personal information unnecessary to implement their opt-out requests; and 5) upon clicking the “Do Not Sell My Personal Information” link, businesses not require consumers to scroll through privacy policies or a long webpage to complete requests to opt-out.
Additional CCPA Modifications
Other proposed modifications to the CCPA regulations touch upon authorized agent verification and the selling of personal information of consumers under sixteen (16) years of age. The proposed modifications would allow for businesses to require authorized agents to provide proof that subject consumers gave the authorized agents signed permission to submit their requests. Under section 999.330 and/or section 999.331, businesses selling personal information of consumers under sixteen (16) years of age would be required to include in their privacy policies a description of their method for verifying authorization of the sale of a minor’s data by the applicable child’s parent or guardian.
It has been a little over a year since the California Department of Justice first published CCPA regulations for public comment. During that period of time, the CCPA regulations have been in a state of flux. In this fluid CCPA compliance environment, businesses must continue to stay up to date on CCPA modifications and comply with all changes. We will continue to monitor CCPA-related developments and apprise our readers of any substantive changes.
If you require assistance with consumer data privacy compliance for your business, please email us at info@kleinmoynihan.com, or call us at (212) 246-0900.
The material contained herein is provided for informational purposes only and is not legal advice, nor is it a substitute for obtaining legal advice from an attorney. Each situation is unique, and you should not act or rely on any information contained herein without seeking the advice of an experienced attorney.
Attorney Advertising
Photo by Christina @ wocintechchat.com on Unsplash
Related Blog Posts:
CCPA Amendment Passes, Creating New HIPAA-Related Exceptions
Clarifying the $25 Million Threshold in the Final CCPA Regulations
