California modifying CCPA regs again

State Issues Privacy/Cyber Risk & Data Security CCPA State Attorney General Consumer Protection

On October 12, the California Department of Justice released a third set of proposed modifications to the regulations implementing the California Consumer Privacy Act (CCPA). As previously covered by InfoBytes, on August 14, the regulations went into effect after being approved by the Office of Administrative Law (OAL). Highlights of the proposed modifications include:

• The addition of Section 999.306, subd. (b)(3), which provides illustrative examples of the methods businesses can use to provide the notice of right to opt-out of the sale of personal information through an offline method, when the business collects personal information in the course of interacting with consumers offline. Examples include: posting signage in the area where personal information is collected or providing the notice orally during calls where information is collected;
• The addition of Section 999.315, subd. (h), which provides illustrative examples of right to opt-out methods that are designed with the purpose or have the substantial effect of subverting or impairing a consumer’s choice to opt-out. Examples include: using double negatives or requiring consumers to click through a list of reasons why they should not opt-out before confirming their request;
• Amending Section 999.326, subd. (a), which clarifies what proof a business may require from an authorized agent and consumer when a consumer uses an agent to submit a request to know or a request to delete; and
• Amending Section 999.332, subd. (a), which clarifies that businesses subject to § 999.330 (consumers under 13 years of age) and/or § 999.331 (consumers 13 to 15 years of age) must include a description of the processes set forth in those section in its privacy policy for consumers under 16 years of age.

Comments on the proposed modifications are due on October 28 by 5:00 p.m.