On Thursday, December 10, 2020, the Office of Attorney General Xavier Becerra published a fourth set of proposed modifications to the regulations of the California Consumer Privacy Act of 2018 (CCPA). Comments to this new set of regulations which are a combination of changes to the third set of modifications proposed in October 2020 and new proposed regulations are due December 28, 2020 at 5:00 pm PST.
This fourth set of modifications proposes five clarifications or changes:
- Offline Notice Requirement. Section 999.306 clarifies that a business that collects personal information offline only needs to inform consumers of their opt-out right by an offline method if the business actually sells the information. These proposed changes are edits in response to the public comments received by the Attorney General in response to the third proposed modifications to the regulations.
- Opt-Out Button Again. Proposed Section 999.306(f) resurrects the opt-out button, which had previously been proposed, but did not make it into the final regulations. The proposed text of this new section is ambiguous, and thus may require further modification. In proposed Section 999.306f(1), the regulation states that the opt-out button "may be used in addition to posting the notice of right to opt-out." (emphasis added). However, in proposed Section 999.306f(2), the language starts simply: "Where a business posts the `Do Not Sell My Personal Information' link, the opt-out button shall be added to the left of the text as demonstrated below." (emphasis added). It is therefore unclear from the proposed modifications whether the use of the opt-out button is mandatory or if it is optional, and if a business elects to use it, describes where the button ought to be placed.
The remaining "changes" are holdovers from the Attorney General's third set of proposed modifications, and were presented without further revision:
- Easy Opt-Out. Proposed Section 999.315(h) clarifies that opt-out requests must be easy to complete and understand. The modifications explain that businesses should limit the number of steps to opt-out, should not use double-negatives, and should not require unnecessary personal information.
- Authorized Agent Proof. Proposed Section 999.326 clarifies that the authorized agent may be required to provide proof of permission to submit a request to know or delete.
- Notices Related To Consumers Under the Age of 16. The Attorney General has proposed clarifying that businesses must give notice of their procedures related to consumers under the age of 16 if the business is subject to regulation under Section 999.330 (consumers under 13) or (previously was "and"), Section 999.331 (consumers aged 13 to 16).