CCPA Regulations Now in Full Effect

Written by: Brian Reece & Melanie Seelig

On August 14, 2020, the Office of Administrative Law (“OAL”) approved the final regulations for the California Consumer Privacy Act (“CCPA”), which are now in full effect.  The California Office of the Attorney General first proposed regulations for the CCPA in October 2019, and the regulations have since gone through several rounds of revisions.  We have previously discussed these regulations at length in this webinar, as well as on this blog here, here, here, and here.

The OAL approved the final text of the CCPA regulations with some minor modifications, most of which are grammatical and textual issues for consistency with the CCPA statute and other sections of the regulations.  Of note, however, the final text of the CCPA regulations no longer permits using the shorthand phrase “Do Not Sell My Info.”  Instead, if a business sells personal information under the CCPA, it must use the full statutory phrase “Do Not Sell My Information” when providing this link on the business’ Internet homepage.  The final text also provides further clarity regarding the circumstances under which a business may deny an authorized agent’s request to opt a consumer out of the sale of his or her personal information.  In the prior version of the CCPA regulations, a business could deny an authorized agent’s request if the agent “does not submit proof” that he or she could act on behalf of the consumer.  The final text replaces this vague provision, and now indicates in Section 999.315(f) that:  “A business may deny a request from an authorized agent if the agent cannot provide to the business the consumer’s signed permission demonstrating that they have been authorized by the consumer to act on the consumer’s behalf.”  Lastly, the OAL removed a provision in the final CCPA regulations requiring a business to obtain “explicit consent” if it uses a consumer’s information in a manner that is materially different from what was disclosed in its privacy notice.  With this change, businesses will simply have to provide an updated privacy notice under Civil Code § 1798.100(b) if the purpose of the data collection changes.

With the final CCPA regulations in full force and effect, businesses should address any gaps in their policies and procedures to ensure compliance.    

Editor: Arsen Kourinian