California Attorney General submits fourth set of CCPA modifications for review

On December 10, 2020, the Attorney General of California released a fourth set of proposed modifications to the California Consumer Privacy Act (“CCPA”). These new modification follow the Attorney General’s proposed regulations released on October 11, 2019, which we’ve previously discussed here, as well as the California Attorney General’s previous modifications on February 10 and March 11, 2020, which we’ve previously discussed here and here.

As we previously discussed here, the Attorney General’s CCPA regulations became effective on August 14, 2020. On October 12, 2020, the Attorney General gave notice of a third set of proposed modifications, which were open for public comment. According to the Attorney General, this newest set of modifications is in response to those public comments and/or to clarify and conform the proposed regulations to existing law.

The December 10, 2020 modifications include the following changes:

• The modifications revised Section 999.306(b)(3), to clarify that a business selling personal information collected from consumers in the course of interacting with them offline shall inform consumers of their right to opt-out of the sale of their personal information by an offline method.
  
   
• The modifications also proposed adding Section 999.315(f), regarding a uniform button to promote consumer awareness of the opportunity to opt-out of the sale of personal information. A similar opt-out button had previously been included in the Attorney General’s first set of modifications, but was scrapped among concerns that the button would generate confusion with consumers. In the new modifications, the opt-out button was redesigned as shown below:
  
• The proposed opt-out button would appear either by itself of or to the left of the text of the businesses “Do Not Sell My Personal Information” link as demonstrated below:

Along with the modifications, the Attorney General also provided notice that 5 documents relied upon in adopting the proposed regulations have been added to the rulemaking file. The documents include several research studies involving how consumers exercise their privacy choices online and the effectiveness of consumer opt-out mechanisms, including the CCPA’s current Do-Not-Sell provision. The list of documents, with links to review the documents, is available on the Attorney General’s website here.

It was also announced last week that Xavier Bacerra is Present-Elect Biden’s nominee for HHS Secretary. While Attorney General Xavier Bacerra remains focused on the CCPA and crafting the necessary regulations with public input, it is uncertain if this possible change might affect the CCPA priorities of the Attorney General’s Office.

Comments to the California Attorney General’s Fourth Set of Proposed Modifications and to the documents and information added to the rulemaking file are due Monday, December 28, 2020 at 5 pm.

Jim Shreve is the chair of Thompson Coburn's Cybersecurity group and has advised clients on cybersecurity and privacy issues for over 20 years. Luke Sosnicki is a Los Angeles partner in Thompson Coburn’s Business Litigation group who has written and spoken extensively about data privacy litigation and regulatory risks.