The final regulations as amended by the Office of Administrative Law became effective August 14, 2020.

On August 14, 2020, the California Office of Administrative Law approved the state Department of Justice’s regulations regarding the California Consumer Privacy Act (CCPA) and filed them with the California Secretary of State. The regulations went into effect immediately.

In approving the regulations, the Office of Administrative Law incorporated an addendum as part of the final rule-making package, which withdrew certain provisions for additional consideration. The key revisions from the addendum include:

• “Do Not Sell My Info” Removed: The option to use the “Do Not Sell My Info” language for the hyperlink to the notice of right to opt out instead of the longer “Do Not Sell My Personal Information” was removed to align with the language of the statute.
• Explicit Consent for New Purpose: Section 999.305(a)(5) was deleted. This required businesses to provide notice and obtain explicit consent from consumers before using personal information for any new business purpose. This provision was controversial as it overreached the rights under the statute, which only requires that a new notice be provided prior to such use.
• Offline Opt-Out Method: Section 999.306(b)(2) was deleted. This required a business that substantially interacts with consumers offline to provide notice via an offline method of their right to opt out. Businesses can now rely solely on their website as a basis for providing the notice of right to opt out.
• Minimum Steps for Opt Out: Section 999.315(c) was deleted. This required a business’ method for opting out of a sale to be easy to execute and involve minimal steps to complete, and prohibited any method designed to subvert or impair a consumer’s decision to opt out.
• Authorized Agent Denial: Section 999.326 was deleted. This allowed a business to deny a request from an authorized agent that does not submit proof that they have been authorized by a consumer to act on their behalf. However, if such proof is not provided, a request can still be denied as unverifiable.
• Severability: The severability section was determined unnecessary and deleted.

The final regulations as amended by the Office of Administrative Law became effective August 14, 2020.

For More Information

If you have any questions related to this Alert, please contact Michelle Hon Donovan, Sandra A. Jeskie, any of the attorneys in our California Consumer Privacy Act Group or the attorney in the firm with whom you are regularly in contact.

Disclaimer: This Alert has been prepared and published for informational purposes only and is not offered, nor should be construed, as legal advice. For more information, please see the firm's full disclaimer.