CCPA gets stronger with new privacy regulations

“SACRAMENTO – California Attorney General Xavier Becerra today announced additional regulations approved by the Office of Administrative Law that advance protections for Californians seeking to control the sale of their personal information. The California Consumer Privacy Act (CCPA) gives consumers new tools and rights for protecting their data privacy. These newly-approved rules strengthen the language of the CCPA regulations approved by OAL in August 2020, including protecting consumers from unlawful business practices that may be deceptive or misleading.

“California is at the cutting edge of online privacy protection, and this newest approval by OAL clears even more hurdles in empowering consumers to exercise their rights under the California Consumer Privacy Act,” said Attorney General Becerra. “These protections ensure that consumers will not be confused or misled when seeking to exercise their data privacy rights. The regulations include an eye-catching Privacy Options icon that guides consumers to where they can opt-out of the sale of their personal information.”

CCPA grants California consumers the right to know, the right to delete, and the right to opt-out of the sale of the personal information collected by businesses. It also affords additional protections for minors. The initial set of regulations went into effect on August 14, 2020. However, the Department had withdrawn certain provisions to clarify processes for businesses subject to the law. Today marks OAL’s approval of the Department’s amendments, the final step in making these regulations effective as law.

The newly-approved regulations ban so-called “dark patterns” that delay or obscure the process for opting out of the sale of personal information. Specifically, it prohibits companies from burdening consumers with confusing language or unnecessary steps such as forcing them to click through multiple screens or listen to reasons why they shouldn’t opt out.

The new regulations also provide businesses with an optional Privacy Options icon. The blue icon was designed by Carnegie Mellon University’s Cylab and the University of Michigan’s School of Information and tested against other icons to determine the best design for communicating the privacy choices available to consumers.

In 2018, California boldly empowered consumers with ground-breaking new rights to control their data bypassing the California Consumer Privacy Act (CCPA). For the last two years, Attorney General Becerra has crafted regulations that operationalize the CCPA for businesses and guide consumers in exercising those rights.

In addition to writing regulations to implement the CCPA, the California Department of Justice enforces the law. Businesses found to be out of compliance with the CCPA receive a ‘notice to cure’ that provides a 30-day window to remedy their non-compliance. Since CCPA enforcement began on July 1, 2020, the Department has seen widespread compliance by companies doing business in California, especially in response to notices to cure.

In November 2020, California voters approved Proposition 24, the California Privacy Rights Act (CPRA), which sought to amend the CCPA. Some of the Attorney General’s responsibilities under the CCPA will transition over to the California Privacy Protection Agency created under CPRA. However, the Attorney General will retain the authority to go to court to enforce CPRA. Enforcement of CPRA will begin in 2023.

A copy of the approved regulations can be found here.”