Finalization of CCPA Regulations

 

Update From The CA-AG

On August 17, 2020, California Attorney General Xavier Becerra announced the finalization of the CCPA regulations, bringing an almost year-long process of refinement to an end. We’ve covered some of the previous rounds of updates to the CCPA elsewhere, but given that this marks the end of long rounds of CCPA wordsmithing, we thought the August 17 clarifications deserved a standalone post.

CCPA Clarifications

The key areas that were refined or clarified in this latest and final round were:

• The “Do Not Sell” requirement was amended such that “Do Not Sell My Info” is not listed as acceptable language for the homepage link requirement. This means only “Do Not Sell My Personal Information” is the only explicitly mentioned acceptable language to use when allowing consumers to exercise this right. If your business has implemented a “Do Not Sell My Info” link on your homepage, it must be modified to “Do Not Sell My Personal Information”.
• Next, the California AG deleted the provision that allowed businesses to deny requests from authorized agents who can’t show proof that they’re authorized to act on consumers’ behalf. However, there are other CCPA provisions that allow businesses some ability to verify authority, including permission to verify with the consumer that the authorized agent has been cleared represent them.
• The AG also removed the requirement that businesses offer an offline mechanism for filing Do Not Sell requests. Instead, businesses can direct users to their online service for managing those requests.
• There were additional clarifications around the upfront consent needed to use consumer data for explicit purposes and the user experience requirements for Do Not Sell requests.

Key Takeaways

The final round of CCPA clarifications skews business-friendly. Some of the more onerous requirements around the Do Not Sell requirement were eased or alleviated. With that said, it’s notable that businesses may now need to do more legwork when scoping their dealings with authorized agents purporting to represent California consumers. Perhaps the highest-level takeaway is that the CCPA text is actually finalized – at least until California returns to the ballot box on November 4, 2020 to vote on “CCPA 2.0”, The California Privacy Rights Act.

Per Future of Privacy Forum policy counsel Pollyanna Sanderson:

This essentially leaves the CCPA as a notice and consent regulatory model, with extra room for potentially coercive consent mechanisms.