PH Privacy

CCPA Final Regulations: California Attorney General Announces Approved CCPA Regulations for Immediate Effect

August 18, 2020

Behnam Dayanim, Brianne Powers and Daniel Julian

On August 14th, the California Office of Administrative Law (OAL) approved the state Department of Justice’s CCPA regulations (the “Final Regulations”) and filed them with the Secretary of State. As previously requested by the California Attorney General, the Final Regulations take effect immediately.

The Final Regulations include additional revisions, detailed in an Addendum to Final Statement of Reasons, and are described by the Office of the Attorney General as “non-substantive” and primarily intended to address issues of “accuracy, consistency, and clarity.”

However, there are a couple of changes of particular note:

• Do Not Sell My Personal Information (Section 999.315): The Final Regulations no longer permit businesses’ “sale” opt-out links to be called “Do Not Sell My Info.” Instead, the link must say “Do Not Sell My Personal Information.”

• More Flexible Offline “Opt-Out Notice”: Section 999.306(b)(2) from the earlier Proposed Regulations mandated that businesses that “sell” personal information and maintain significant offline interactions with consumers must provide a notice of the right to opt-out of “sales” through an offline method as well. This section was removed in the Final Regulations, giving businesses that operate primarily offline additional flexibility in choosing how to provide this notice. However, the newly renumbered Section 999.306(b)(2) still requires any business not operating a website to “establish, document, and comply with another method by which it informs consumers of their right to opt-out.”

• Authorized Agent Authorization:  Section 999.326(c) has been withdrawn and Section 999.315(f) (formerly sub-section (g)) has been amended to clarify what an “authorized agent” must provide when submitting a request on behalf of a consumer. The net result is that, per the updated Section 999.315(f), a request to opt-out submitted by a consumer’s authorized agent may be denied “if the agent cannot provide to the business the consumer’s signed permission demonstrating that they have been authorized by the consumer to act on the consumer’s behalf.”

• Underage Consumers: The use of the term “minor” has been changed to “consumer” and additional updates to clarify ages related to specific requirements have been included.

Click here for an unofficial redline .PDF of the Final Regulations of the CCPA, as prepared by Paul Hastings, which more clearly shows the changes from earlier Proposed Regulations submitted by the CA Attorney General.