The Attorney General Regulations (Regulations) to the California Consumer Privacy Act (CCPA) are enforceable as of August 14, 2020.
Attorney General Xavier Becerra announced that the Office of Administrative Law (OAL) approved the final Regulations, which were submitted for the OAL’s review earlier this summer on June 1, 2020. During the OAL review process, additional revisions were made to the Regulations.
The additional revisions made during the OAL review process include the following:
First, the text of the Regulations updated the term “child” to “consumer under 13 years of age.” This will clarify that the requirements related to children under 13 years of age only apply to California resident “consumers” under that age.
Second, the Regulations replaced “retention” with “deletion” in the definition of “financial incentive.” The definition of “financial incentive” is updated to mean a program, benefit, or other offering related to the “collection, deletion, or sale of personal information.” This is a subtle alteration to clarify that collection, deletion, or sale are the key processing activities considered important for financial incentive compliance requirements.
Third, the Regulations deleted a provision stating that when a business uses a consumer’s personal information for a purpose materially different than those disclosed in the notice at collection, the business must notify the consumer and obtain explicit consent for this new purpose. Although businesses should still directly notify consumers for materially new uses of information than those purposes presented to the consumer at the time of collection, it is possible that the “explicit consent” requirement presented too many questions as it is not yet a common practice.
Fourth, previously there were two options for how businesses could name their opt-out of sale link. The links could be titled, “Do Not Sell My Personal Information” or “Do Not Sell My Info.” Now, businesses must use the following title for the opt-out hyperlink: “Do Not Sell My Personal Information.”
Companies that have been following the proposed regulations will be in a good place to make final revisions to their practices in light of these edits made to the OAL approved Regulations.
