The California Attorney General has announced approval of new regulations to the California Consumer Privacy Act (CCPA), which went into effect on March 15, 2021. The modified regulations are summarized below:
New Opt-Out Icon and Offline Opt-Out Methods:
- Section 999.306 now provides an optional opt-out icon.
- Businesses may use this icon in addition to (but not as a replacement to) related requirements for purposes of notifying consumers of the right to opt-out of the sale of personal information and posting a “Do Not Sell My Personal Information” link. If used, the icon must be approximately the same size as other icons used by a business on its website.
- Section 999.306 also provides examples of how a business that sells personal information collected in the course of interacting with consumers offline can provide the notice of right to opt-out of the sale of personal information through an offline method, including providing the notice (1) On paper forms; (2) On signage where personal information is collected; and (3) Orally when personal information is collected over the phone.
Easy-to-Execute Opt-Out Methods
- Section 999.315 now emphasizes that a business’s methods for submitting requests to opt-out should be easy to execute and require minimal steps.
- Examples of prohibited methods that may impair a consumer’s right to opt-out include (1) Requiring more steps to opt out than to opt-back-in (after previously opting-out); (2) Using deceptive or confusing language, such as double-negatives in the opt-out; (3) Attempting to convince consumers not to opt-out before confirming requests to opt-out; (4) Requiring unnecessary personal information from consumers for opt-out requests; and (5) Requiring consumers to scroll through documents (including privacy policies) to locate opt-out mechanisms.
Authorized Agent Verification
- Section 999.326 clarifies the proof that a business may require a consumer’s authorized agent to provide, as well as what the business may require of a consumer in order to verify that an authorized agent has permission to submit requests to know and/or requests to delete on the consumer’s behalf.
Notices to Consumers Under 16 Years
- Section 999.332 clarifies that a business subject to special rules related to the sale of the personal Information of consumers under 13 years of age (Section 999.330) and/or consumers 13 to 15 years of age (Section 999.331) are required to include a description of the processes set forth in those sections in its privacy policies.
Fey LLC will continue to closely monitor developments in state, federal, and global privacy laws and regulations. To ensure you don’t miss out on any articles and alerts we prepare on this or other significant data protection laws and developments, you can follow our LinkedIn page here.
Will Davis, a law clerk with Fey LLC and a law student at the University of Florida-Levin College of Law contributed to this post.