More responses from the California Attorney General to questions about the final California Consumer Privacy Act regulations:

Q. Can a business use an IP address to determine if a website visitor is a California consumer?

California Attorney General: Can’t confirm or deny.

“Nothing prevents a business from using an IP address to determine the location for valid business purposes. Whether or not that is a reliable or definitive method to determine residency raises specific legal questions that may require a fact specific determination.”

Q: Should backup and archive systems be excluded from the deletion requirement pursuant to a CCPA consumer delete request?

AG: No.

The requirement to comply persists and is simply delayed for as long as the information is stored in archived, non-active mode.

Q: When a consumer files an opt-out request but you have shared information with a third party after receipt of the request — when do you need to tell third parties not to further sell?

AG: Within 15 days of receipt of the request.

Note that the default requirement regarding opt-out requests is to fulfill the request “as soon as feasibly possible.”

Based on the European experience with “without undue delay” (which applies to data breach notifications), “as soon as feasibly possible” is a fact-specific analysis but regulators scrutinize the facts carefully.

[View source.]