California AG Releases Fourth Set of Proposed Modifications to CCPA Regulations

On December 10, the California attorney general released the fourth set of proposed modifications (Proposed Modifications) to the implementing regulations of the CCPA. These Proposed Modifications come only one month after California voters passed the California Privacy Rights Act of 2020 (CPRA) into law.

The Proposed Modifications make minimal changes to the third set of proposed modifications released on October 12. The Proposed Modifications, if adopted, would require the following:

• Offline Notice of the Right to Opt Out and Methods to Submit an Opt-Out Request for Businesses that Sell Personal Information Collected Offline. Previously, the third set of proposed modifications required businesses collecting personal information offline (e.g., in person or via telephone) to provide an offline notice of the consumers’ right to opt out of the sale of personal information. The Proposed Modifications change this requirement to apply only to businesses selling personal information collected offline, while requiring them to inform consumers by an offline method of their right to opt out and how to submit an opt-out request. For instance, a business that sells personal information collected from consumers in a brick-and-mortar store may inform consumers of their right to opt out on paper forms that collect the personal information or by posting signage in the area where the personal information is collected, directing consumers to where the opt-out information can be found online. For a business that sells personal information collected over the phone, the business may inform consumers of their opt-out rights orally during the call when the information is collected.

• Opt-Out Button. The Proposed Modifications revive the ability for businesses to use an opt-out button in addition to posting a notice of right to opt out, which was included and later deleted in previous versions of the CCPA implementing regulations. If businesses use the button as a method for submitting an opt-out request, the button must be placed to the left of the text where a business posts the “Do Not Sell My Personal Information” link as required by the CCPA and the implementing regulations. The button must also link to the same internet webpage or online location to which the consumer is directed after clicking on the “Do Not Sell My Personal Information” link. The button must be approximately the same size as any other buttons on the business’s webpage. It is important to note that the opt-out button is in addition to and not in lieu of any requirement to post an opt-out notice or a “Do Not Sell My Personal Information” link as required under the CCPA and its implementing regulations.

The Proposed Modifications are subject to a public comment period with a deadline to submit written comments by December 28, 2020 at 5 p.m. PST. As the CCPA and its implementing regulations continue to change, most recently with the passage of the CPRA into law, businesses should continue to monitor all developments relating to the CCPA, including any additional modifications to the regulations and guidance from the California attorney general. For information on how to comply with the CCPA, see Troutman Pepper’s article series on CCPA enforcement available here.