California Attorney General Files Final Proposed Regulations for The California Consumer Privacy Act of 2018

06.25.2020

On June 1, 2020, the California Attorney General submitted the text of the final proposed California Consumer Privacy Act of 2018 (CCPA) to the California Office of Administrative Law (OAL) for its review. This is the last step in a rulemaking process that began eight months ago. While the CCPA has been in force since January 1, 2020, the Act specified that the Attorney General could not commence enforcement of the Act until the earlier of formal adoption of the regulations or July 1, 2020. Our previous summary the Act can be found here. 

Thus, while the Attorney General may commence enforcement of the CCPA on July 1, 2020, it is not clear when the proposed final regulations will be enforceable. The OAL has up to 30 working days from June 1, 2020, plus an additional 60 calendar days pursuant to Governor Newsom’s Executive Order N-40-20 in connection with the pandemic, to review the regulations to ensure they comply with the California Administrative Procedure Act. For its part, the Attorney General has asked the OAL to expedite its review so that the regulations can be enforceable as soon as possible within the 30 working-day period. Once the OAL completes its review, the final regulations will be filed with the Secretary of State and formally adopted.

The regulations provide further guidance and clarity regarding the CCPA’s requirements, including for privacy policies and notices, handling of and procedures for verifying requests from California consumers, special rules for minors and prohibitions on discriminatory practices. Key aspects of the regulations include:

• Specific content, accessibility, format and other requirements for privacy policies and other privacy notices, including notices for the right to opt-out of the sale of information, and notices of financial incentives related to personal information;
• Business practices for handling consumer requests, including guidance and processes for submission of and responses to requests for information about, or deletion of personal information and request to opt-out of the sale of such information;
• Specific requirements for service providers to businesses subject to the CCPA, including scope of rights for handling of personal information;
• Requirements for handling Opt Out requests, including placement and mechanics of “Do Not Sell My Personal Information” links;
• Training and record-keeping requirements for consumer requests, including special requirements and disclosures for businesses that share or sell the personal information for more than 10,000 consumers in a year;
• Requirements to have consumers and minors to opt-in to the processing of personal information under certain circumstances;
• Guidance regarding methods of verifying consumers submitting requests; and
• Clarification regarding procedures for offering financial incentives or service options related to collection of personal information and valuing consumer data.

While the regulations provide some much-needed clarity to the CCPA, there are still many issues that remain vague, including the full scope and permitted uses of “personal information” subject to the Act. We will continue to monitor developments on the CCPA and other privacy laws that may impact your business and are available to answer any questions that you may have.