On Monday, October 12, 2020, the Office of Attorney General Xavier Becerra published a third set of modifications to the regulations of the California Consumer Privacy Act of 2018 (CCPA). The CCPA regulations, last modified on March 11, 2020, became effective on August 14, 2020.

This third set of modifications seeks to provide straightforward guidance and clarity with respect to four areas:

  • Offline Notices. The third set added section 999.306(b)(3), explaining that businesses that collect personal information in the course of acting with consumers offline must provide notice of a consumer's right to opt-out through an offline method. The new section provides examples of acceptable methods, including providing printouts, posting signs, and proving notice orally over the phone.
  • Easy Opt-Out. New regulation section 999.315(h) requires that a business' methods for submitting opt-out requests be easy and require minimal steps. The new section provides five examples of what a business should not do: (1) require a consumer to go through more steps to opt-out than to opt-in, (2) use confusing language such as double negatives, (3) require consumers to listen to reasons why they should not submit a request to opt-out beyond what is permitted in the regulations, (4) require personal information not necessary to implement the request, and (5) require a consumer to scroll a long document upon clicking the "Do Not Sell My Personal Information" link.
  • Authorized Agent Proof. The proposed regulations revise section 999.326(a) to clarify that a business may require an authorized agent to provide proof that the consumer gave permission to submit a request.
  • Privacy Policies and Children. The third set of regulation revisions amend existing section 999.332(a) to clarify that businesses subject to either section 999.330 (concerning consumers under 13 years old), section 999.331 (concerning consumers 13-15 years old), or both of these sections must include a description of the processes set forth in those sections in their privacy policies.

The deadline to submit comments regarding these new modifications is October 28, 2020 at 5:00 p.m.