On October 10, 2019, the California attorney general released long-awaited proposed regulations under the California Consumer Privacy Act ("CCPA"). These regulations provide much-needed guidance on the CCPA requirements, including:
- The contents and format of a business's privacy policy;
- Consumer notice requirements;
- Responses to access, deletion, and opt-out requests;
- Verification of consumer requests; and
- Processing of minors' personal information.
The attorney general also released a statement clarifying the reasoning underlying the proposed regulations.
The attorney general's office will be holding four public hearings across the state for interested parties to provide oral and written comments regarding the regulations. These hearings are set for the first week of December 2019. Interested parties can also submit written comments via email or mail. The public comment period closes on December 6, 2019, at 5:00 p.m. PST. The attorney general may bring enforcement actions pursuant to the CCPA six months after the final rules are adopted or starting on July 1, 2020 (whichever is sooner).
The release of these proposed regulations will be quickly followed by the adoption (or rejection) of several CCPA amendments currently awaiting the California governor's signature. The governor has until October 13, 2019, to veto any pending bills. If not, they become law.
For now, companies should begin comparing their compliance programs against these regulations to determine whether their programs align with the attorney general's interpretation of the CCPA or whether adjustments need to be made. And although these regulations are not final and may change in several months, they serve as a good indication of the attorney general's enforcement priorities.
