California AG Releases Fourth Set of Modifications to CCPA Regulations

On December 10, 2020, California Attorney General Xavier Becerra (California AG) released a fourth set of proposed modifications to the California Consumer Privacy Act (CCPA) regulations that went into effect on August 14, 2020. These modifications reflect minor changes to the third set of modifications to the regulations (published on October 12, 2020).

What’s New in the Fourth Set of Modifications:

The fourth set of modifications focus on notice obligations for businesses that sell personal information that is collected offline and the re-introduction of a “Do Not Sell My Personal Information” button.

Offline Notice of Sale of Personal Information Collected Offline: The fourth set of proposed modifications clarify the third set of modification’s obligations for businesses that sell personal information collected offline. The third set of proposed modifications required businesses that collected personal information from consumers offline to provide notice of consumers right to opt-out of the sale of personal information using an offline method. The fourth set of modifications narrow this requirement to apply to businesses that sell personal information collected offline. Specifically, these businesses must provide an offline method to inform consumers of their right to opt-out of the sale of their personal information with instructions on how to submit an opt-out request.  As an example, a business that sells personal information collected in a brick-and-mortar store may inform consumers using the paper forms used to collect the personal information or, alternatively, by posting a sign in the area where the personal information is collected. If a business collects personal information over the phone, the business may orally inform consumers of their right to opt-out at the time the information is collected.

“Do Not Sell My Personal Information” Button: The proposed modifications also re-introduce a “Do Not Sell My Personal Information” button that businesses may use in addition to posting the notice of the right for consumers to opt-out of the sale of personal information. The opt-out button appeared in the California AG’s proposed regulations in February 2020 but was removed. The opt-out button must be added to the left of the text “Do Not Sell My Personal Information” and must be the same size as any other buttons used by the business on their website. The button must link to the same website or location to which the consumer is directed after clicking the “Do Not Sell My Personal Information” link.

An example of the button is below:

The fourth set of proposed modifications include a public comment period that closed at 5:00 p.m. PST on December 28, 2020. With the ever-changing regulations and the addition of the newly passed California Privacy Rights Act of 2020 (CPRA), companies should continue to evaluate their CCPA and privacy compliance programs.

If you have any questions about your business’s approach to CCPA or privacy compliance, please contact your Orrick privacy counsel for additional guidance. For information on the CPRA, stay tuned for our forthcoming CPRA Insight series.