On July 8, 2022, the California Privacy Protection Agency commenced the formal rulemaking process to adopt regulations to clarify and implement the amendments to the California Consumer Privacy Act (“CCPA”). The amendments will go into effect on January 1, 2023.

The amendments will expand the rights of consumers and will increase the corresponding compliance obligations on businesses. Key changes to the CCPA include:

• Employees and individuals acting as representatives of businesses will be covered.
• Consumers will have the right to “opt-out” of the sharing of personal information with third parties for cross-context behavioral advertising purposes.
• Consumers will have the right to limit the use of “sensitive” personal information.
• Websites must recognize and respond to user generated opt-out preference signals.
• Businesses must enter into or update their contracts with service providers, contractors and third parties that receive personal information.
• Privacy policies must be updated to add new disclosures and notifications.

Businesses should prepare now.

Businesses, particularly businesses that provide services or goods online, should begin immediately to prepare for the amended CCPA. The amended law will not merely require businesses to update their privacy policies. It will be necessary for businesses to review their personal data collection and processing operations and implement the necessary technical infrastructure and internal procedures and practices to comply with the new requirements. Demand for compliance advice will be high in the fourth quarter of 2022, so businesses are advised to start now.