The California Department of Justice ("DOJ") has provided notice of yet another round of proposed modifications to the California Consumer Privacy Act ("CCPA"). This fourth set of new CCPA modifications addresses the twenty (20) comments businesses submitted in response to the third set of modifications on October 12, 2020. The DOJ will accept written comments on the new CCPA modifications until 5:00 p.m. on December 28, 2020.
What are the new CCPA modifications?
New CCPA Modifications
With each modification to the CCPA, the DOJ gets closer and closer to a set of regulations free of ambiguities. This most recent set of modifications makes changes to Section 999.306 - Notice of Right to Opt-Out of Sale of Personal Information. In Section 999.306, the third set of modifications had added new language to address businesses that collect personal information while interacting with consumers offline, i.e., in brick-and-mortar stores or over the phone. The new CCPA modifications include clarification of the fact that this regulation is meant for businesses that sell (and share for commercial purposes) consumer personal information, not businesses that simply collect personal information. The new CCPA modifications to Section 999.306 also include additional language regarding the button that consumers can use to opt-out of the sale of their personal information. Specifically, businesses may use the opt-out button in addition to the "Do Not Sell My Personal Information" link, but not in lieu thereof. Where the opt-out button is used, it should be posted to the left of the text, as shown below.
Businesses that choose to use the opt-out button must display the button in approximately the same size as any of the other buttons that may appear on their webpages.
Future Changes
The State of California requires governmental agencies to provide notice of all regulatory modifications and a period for public comment. Here, if changes are made to the current CCPA regulations after the new comments are reviewed, the DOJ must provide for another notice and comment period.
In addition to the foregoing proposed CCPA modifications, Californians recently voted to approve Proposition 24, the California Privacy Rights Act ("CPRA"), amending the CCPA to significantly expand privacy rights. On January 1, 2023, the CPRA will become operative, and apply to consumer information collected on or after January 1, 2022. On July 1, 2023, the CPRA will become enforceable by the California Privacy Protection Agency. Until that time, businesses should comply with the current CCPA and any future interim modifications thereto.
As readers of this blog know, we have been diligently following all proposed new CCPA modifications and notifying our readers when they are released for comment. Although many businesses are exhausted by the constant changes to the CCPA, they must remain vigilant in abiding by all applicable compliance requirements. To assist in this process, working with experienced counsel will go a long way in helping businesses avoid potential violations of California consumer privacy laws.
If you require assistance with consumer data privacy compliance for your business, please email us at info@kleinmoynihan.com, or call us at (212) 246-0900.
The material contained herein is provided for informational purposes only and is not legal advice, nor is it a substitute for obtaining legal advice from an attorney. Each situation is unique, and you should not act or rely on any information contained herein without seeking the advice of an experienced attorney.
Photo by Austin Distel on Unsplash
Related Blog Posts:
How the CPRA Law Overhauls and Updates the CCPA
I Received a CCPA Enforcement Notice! How do I Respond?
How Does the CPRA Compare to the GDPR? Ask a CPRA Lawyer
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
