PH Privacy

California DOJ Announces a Third Set of Proposed Modifications to the CCPA Regulations

October 14, 2020

Bianca Ponziani

The California Department of Justice (“DOJ”) announced this week a third set of proposed modifications to the California Consumer Privacy Act (“CCPA”) regulations last updated in August 2020, as we reported here. The following proposals are of particular note:

• Offline notice of the right to opt-out (proposed § 999.306(b)(3)).

  Businesses that collect consumers’ personal information offline (e.g., in a brick-and-mortar store) must provide consumers offline notice of their right to opt out of the sale of their personal information—for example, via signage referring consumers to an online notice, placed in the location where their personal information is collected.

• Straightforward mechanism to opt-out (proposed § 999.315(h)).

  Businesses must provide a simple, streamlined method for consumers who wish to opt out of the sale of their personal information. This means minimal steps from the point of request (the moment the consumer clicks the “Do Not Sell My Personal Information” link) to the completion of that request. Businesses must not require consumers to provide more personal information than necessary to fulfill the request, nor make consumers scroll through a privacy policy in order to locate the mechanism for submitting the request.

• Proof of authorized agent (proposed § 999.326(a)).

  Businesses may require a consumer’s authorized agent to provide proof that the consumer has permitted the agent to submit a “request to know” or a “request to delete” (as those terms are respectively defined in the regulations) on their behalf.

• Clarification for businesses selling the personal information of minors (proposed § 999.332(a)).

Businesses that have actual knowledge that they sell the personal information of consumers under the age of 13 or between the ages of 13 and 16 (or both) must ensure that their privacy policy articulates the requirements listed in sections 999.330 and/or 999.331.

A redline of the proposed changes can be consulted here. The California DOJ is accepting written comments to the proposed regulations until October 28, 2020.

As the CCPA continues to evolve (for example, just last week we reported on the extension of the CCPA’s HR and B2B communications carve-outs contemplated by AB-1281), we will continue to report on important clarifications and modifications.