California AG Announces Approval of Fourth Set of Modifications to CCPA Regulations

On March 15, California Attorney General Xavier Becerra announced that the California Office of Administrative Law approved his fourth set of proposed modifications to the California Consumer Privacy Act’s (CCPA) implementing regulations (Fourth Set of Modifications), completing the finalization process.

In announcing the approval of the Fourth Set of Modifications, Attorney General Becerra noted that these revisions intend to “ensure that consumers will not be confused or misled when seeking to exercise their data privacy rights.” And, indeed, the regulations focus on providing consumers with clarity as to how they can opt out of the sale of their personal information.

Dark Patterns. The newly approved Fourth Set of Modifications ban so-called “dark patterns” that delay or obscure the process for opting out of the sale of personal information. Without defining precisely what constitutes a prohibited practice, businesses may not burden consumers seeking to opt out with confusing language or unnecessary steps, such as requiring them to click through multiple screens or listen to reasons why they may not want to opt out of the sale of their personal information.

Privacy Options Icon. The Fourth Set of Modifications also permit businesses to use an opt-out icon in addition to any “Do Not Sell My Personal Information” link. The icon must be approximately the same size as any other icons used by the businesses on their webpage, and must appear in the prescribed form:

Offline Right-to-Opt-Out Notice. The Fourth Set of Modifications require businesses that sell personal information that they collected offline to provide an offline right-to-opt-out notice. For example, for businesses that collect personal information in brick-and-mortar stores, the notice — which may direct consumers to an online privacy policy — may be provided on the paper forms used to collect personal information or on signage posted in the area where personal information is collected. For businesses that collect personal information over the phone, the notice should be provided orally over the phone at the time the information is collected (and with consent of all parties, recorded and stored).

As the CCPA and its implementing regulations continue to change, most recently with the passage of the California Privacy Rights Act (CPRA), businesses should continue to monitor all developments relating to the CCPA, including any additional modifications to the regulations and guidance from the California attorney general. Businesses should also closely monitor any CPRA developments, as things may change between now and the CPRA’s January 1, 2023 effective date. For information on how to comply with the CCPA, see Troutman Pepper’s article series on CCPA enforcement available here.