Final CCPA Regulations Approved and Effective Immediately

On August 14, 2020, the California Office of Administrative Law (OAL) approved the final regulations under the California Consumer Privacy Act (CCPA) to be effective immediately.

While July 1, 2020 signaled the start of CCPA enforcement, the finalized regulations solidify the compliance obligations for businesses and data privacy rights for consumers under the law. The proposed final regulations submitted on June 1, 2020, underwent additional OAL revisions that were largely grammatical and linguistic with the following substantive changes.

Explicit Consent for Materially Different Use

Businesses are no longer required to notify consumers directly and obtain their explicit consent prior to using their personal information for materially different purposes.

Offline Opt-Out Notice

Businesses that substantially interact with consumers offline are no longer required to provide notice of their opt-out rights. Point of collection notices must still be provided, but consumers can rely on a businesses’ online privacy policy to receive the disclosures. Nevertheless, businesses that do not operate a website have to implement another method to inform consumers of this right.

Opt-Out Method

The requirement that the method to submit opt-out requests be easy for consumers and with minimal steps was removed.

Authorized Agent

Businesses can no longer deny a request to opt-out from an authorized agent that does not provide evidence of authorization from the consumer. There are other CCPA provisions that detail other methods for a business to deny a request from an authorized agent.

Opt-Out Link

The opt-out link must read “Do Not Sell My Personal Information” to be a compliant link as opposed to other currently used versions used by businesses.

Next Steps

While no rationale was provided for these changes, the California Attorney General is permitted to resubmit the withdrawn provisions after further review and possible revision. These regulations establish a long-awaited roadmap that grant some additional flexibility, but businesses must remain cognizant of the remaining obligations in the CCPA and general consumer protection laws that broadly ban unfair and deceptive trade practices. Additionally, the California Privacy Rights Act (CPRA) qualified as a 2020 ballot initiative, which will further shape the California data privacy landscape, if passed.

Never miss an update: Check back for ongoing updates or visit OneDigital’s Compliance Confidence Page for the latest developments and the impact on your business.