The California Department of Justice (“DOJ”) announced this week a third set of proposed modifications to the California Consumer Privacy Act (“CCPA”) regulations last updated in August 2020, as we reported here. The following proposals are of particular note:
- Offline notice of the right to opt-out (proposed § 999.306(b)(3)).
Businesses that collect consumers’ personal information offline (e.g., in a brick-and-mortar store) must provide consumers offline notice of their right to opt out of the sale of their personal information—for example, via signage referring consumers to an online notice, placed in the location where their personal information is collected.
- Straightforward mechanism to opt-out (proposed § 999.315(h)).
- Proof of authorized agent (proposed § 999.326(a)).
Businesses may require a consumer’s authorized agent to provide proof that the consumer has permitted the agent to submit a “request to know” or a “request to delete” (as those terms are respectively defined in the regulations) on their behalf.
- Clarification for businesses selling the personal information of minors (proposed § 999.332(a)).
A redline of the proposed changes can be consulted here. The California DOJ is accepting written comments to the proposed regulations until October 28, 2020.
As the CCPA continues to evolve (for example, just last week we reported on the extension of the CCPA’s HR and B2B communications carve-outs contemplated by AB-1281), we will continue to report on important clarifications and modifications.