The California Consumer Privacy Act ("CCPA") was enacted in early 2018 as a political compromise to stave off a poorly drafted, and plaintiff’s friendly ballot initiative. Although the CCPA is scheduled to go into force in early 2020, there is a great deal of confusion regarding the requirements of the CCPA, including the degree to which it aligns with other privacy regulations such as the European General Data Protection Regulation (“GDPR”).

To help address that confusion, BCLP published the California Consumer Privacy Act Practical Guide, and is publishing a multi-part series that discusses the questions most frequently asked by clients concerning the CCPA.

Q. What rules will California’s Attorney General propose to interpret the CCPA?

The CCPA requires that California’s Office of the Attorney General adopt rules and regulations addressing the following topics within the CCPA:

1. Definition of “Personal Information.” Update (if needed) the definition of personal information to include additional categories to address changes in technology, data collection practices, obstacles to implementation, and privacy concerns.1

2. Definition of “Unique Identifiers.” Update (if needed) the definition of “unique identifiers” to address changes in technology, data collection practices, obstacles to implementation, and privacy concerns, as well as to facilitate the ability of a consumer to make an access request.2

3. Exceptions for compliance with state law. Establish exceptions needed to comply with other state laws.3

5. Opt-out of sale requests. Provide guidance conceding the submission of requests by consumers to opt-out of the sale of information.5

6. Opt-out of sale requests. Provide guidance conceding the submission of requests by consumers to opt-out of the sale of information.6

7. Opt-out of sale implementations. Provide guidance to businesses on how to comply with a consumer’s request to opt-out of the sale of their information.7

8. Opt-out logo or button. Develop a “recognizable and uniform opt-out logo or button” that could be used by businesses.8

9. Increase gross revenue threshold for businesses. Increase, every other year, the $25 million gross revenue threshold that triggers whether the CCPA applies to a business to account for inflation.9

10. Business disclosures. Establish procedures (and any exceptions) “necessary to ensure” that the notices and information that businesses provide under the CCPA are conveyed in a manner that may be easily understood by the average consumer, are accessible to consumers with disabilities, and are in the language primarily used to interact with consumers.10

In addition to the issues identified above, the Office of the Attorney General is embowered to adopt “additional regulations as necessary to further the purposes” of the CCPA.