On October 12, 2020, California Attorney General Becerra’s office released a third set of proposed modifications to the California Consumer Act (CCPA) regulations. While these proposed changes to the final CCPA regulations are relatively targeted, businesses subject to the broad California privacy law should continue to review and enhance their compliance programs to confirm ongoing alignment with the Attorney General’s expectations and guidance.     

Specifically, the proposed changes to the final regulations include:

• Examples of methods for providing consumers with a Notice of Right to Opt-Out in “offline” scenarios, such as brick-and-mortar stores or businesses that collect information over the phone.
• Further obligations to ensure that “[a] business’s methods for submitting requests to opt-out shall be easy for consumers to execute and shall require minimal steps to allow the consumer to opt-out.” The proposed rule would prohibit methods that are “designed with the purpose or ha[ve] the substantial effect of subverting or impairing a consumer’s choice to opt-out,” including by limiting the number of steps required to execute an opt-out and prohibiting a business from requiring a consumer to scroll through the privacy policy to access the opt-out option.
• Amended parameters for what a business may require—from both authorized agents and consumers—when a consumer uses an authorized agent to submit a request to know or a request to delete.
• A clarification under the CCPA’s rules for notices to consumers under the age of 16.

This latest round of proposed modifications follows a long and complex preliminary rulemaking and rulemaking  process that stretched for over a year and included multiple draft versions of the rules.  On August 14, 2020, the rules finally came into effect—8 months after the law became effective and a month after AG enforcement of the CCPA began. 

Stakeholders can submit comments on the proposed changes until October 28, 2020.