After what seemed like a set of fits and starts for the California Consumer Privacy Act (CCPA), which went into effect on January 1, 2020, California Attorney General Xavier Becerra announced the approval of the final regulations for the CCPA on August 14, 2020. While enforcement of the CCPA began on July 1, 2020, the absence of final regulations had many businesses and lawyers wondering if the final regulations would contain any substantive changes.

Not surprisingly, beyond the expected grammatical and linguistic changes, a few key highlights emerged:

• Consent Not Required for Materially Different Use of Information: The final regulations no longer require businesses to obtain consent before using personal information for materially different purposes other than those disclosed at the time of collection.
• Use "Do Not Sell My Personal Information": The final regulations demonstrate that there is no flexibility for how businesses must signal to consumers how they can opt out of the sale of their personal information. Businesses must use the language "Do Not Sell My Personal Information" in the opt-out link.
• Offline Notice Set Aside: The final regulations no longer require businesses that "substantially" interact with consumers offline to also provide notice to those consumers about their rights through paper notices, signage, or on paper receipts.
• No More "Easy" Opt Out: The final regulations no longer mandate that businesses make their methods for opting out of the sale of personal information "easy" or that "minimal steps" be required.

The changes that emerged in the final regulations may appear to be advantageous to businesses, but should not be mistaken for a suggestion that the attorney general's office will be lax in its enforcement of the CCPA. Additionally, businesses must continue to be aware of their obligations under federal law to provide appropriate notice and obtain requisite consents. And, as always, a good rule of thumb with California legislation: there could always be more changes.

While some businesses may be satisfied that the "rules of the road" are firmly established, the finalization of the CCPA regulations may not be the end of privacy regulation in California. There are several amendments to the CCPA pending before the California Legislature.

Also, on June 24, 2020, the California Privacy Rights Act (CPRA) qualified as an initiative for the November 3, 2020, election. If passed, the CPRA, also referred to as "CCPA 2.0," would create a host of additional compliance obligations for businesses, applying to any information collected after January 1, 2022. Businesses would have until January 2023 to come into compliance.

With the uncertainty of COVID-19, the lack of final CCPA regulations may have precipitated a stall or slowing of compliance for your business. But make no mistake: enforcement is underway and is expected to increase.