CCPA Final Regulations are Approved and Enforceable

ArentFox Schiff
Contact

Arent Fox

The Attorney General Regulations (Regulations) to the California Consumer Privacy Act (CCPA) are enforceable as of August 14, 2020.
 

Attorney General Xavier Becerra announced that the Office of Administrative Law (OAL) approved the final Regulations, which were submitted for the OAL’s review earlier this summer on June 1, 2020. During the OAL review process, additional revisions were made to the Regulations.

The additional revisions made during the OAL review process include the following:

First, the text of the Regulations updated the term “child” to “consumer under 13 years of age.” This will clarify that the requirements related to children under 13 years of age only apply to California resident “consumers” under that age.

Second, the Regulations replaced “retention” with “deletion” in the definition of “financial incentive.” The definition of “financial incentive” is updated to mean a program, benefit, or other offering related to the “collection, deletion, or sale of personal information.” This is a subtle alteration to clarify that collection, deletion, or sale are the key processing activities considered important for financial incentive compliance requirements.

Third, the Regulations deleted a provision stating that when a business uses a consumer’s personal information for a purpose materially different than those disclosed in the notice at collection, the business must notify the consumer and obtain explicit consent for this new purpose. Although businesses should still directly notify consumers for materially new uses of information than those purposes presented to the consumer at the time of collection, it is possible that the “explicit consent” requirement presented too many questions as it is not yet a common practice.

Fourth, previously there were two options for how businesses could name their opt-out of sale link. The links could be titled, “Do Not Sell My Personal Information” or “Do Not Sell My Info.” Now, businesses must use the following title for the opt-out hyperlink: “Do Not Sell My Personal Information.”

Companies that have been following the proposed regulations will be in a good place to make final revisions to their practices in light of these edits made to the OAL approved Regulations.

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© ArentFox Schiff | Attorney Advertising

Written by:

ArentFox Schiff
Contact
more
less

PUBLISH YOUR CONTENT ON JD SUPRA NOW

  • Increased visibility
  • Actionable analytics
  • Ongoing guidance

ArentFox Schiff on:

Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
- hide
- hide