Back in August, after much anticipation and several rounds of review and modification, the California Consumer Privacy Act (CCPA) regulations finally became effective. This was long awaited by businesses and their service providers looking for compliance guidance and clarity on key issues related to facilitation of consumer rights.  This week, the California Department of Justice (“DOJ”) announced there would now be a third set of proposed modifications made to the CCPA regulations.

As a quick recap of past of developments related to the CCPA regulations, the DOJ first published CCPA proposed regulations on October 11, 2019.  In February 2020 and again in March, the DOJ gave notice of modifications to the proposed regulations, based on comments received during the relevant public commentary periods.  The final version of the CCPA regulations that became effective in August, was substantively unchanged from the previous version from March.

Below are highlights from the third set of proposed modifications made to the CCPA regulations, released this week:

• Addition of examples of how businesses that collect personal information in the course of interacting with consumers offline can provide the notice of right to opt-out of the sale of personal information through an offline method.
• Guidance on how a business’s methods for submitting requests to opt-out should be easy and require minimal steps. It provides illustrative examples of methods designed with the purpose or substantial effect of subverting or impairing a consumer’s choice to opt-out.
• Clarification on the proof that a business may require an authorized agent to provide, as well as what the business may require a consumer to do to verify their request.
• Clarification that businesses that have actual knowledge that they sell PI of minors are required to include in their privacy policies a description of their method for verifying that the person authorizing the sale of a child’s data is actually that child’s parent or guardian.

The DOJ’s notice regarding the proposed modifications and a comparative version of the new text are available here.  The DOJ will accept written comments from the public regarding the proposed modifications between Tuesday, October 13, 2020 and Wednesday, October 28, 2020. Written comments may be submitted to the DOJ via email to PrivacyRegulations@doj.ca.gov.

Since the CCPA’s effective date back in January there have been an influx of developments, as the legislature and regulators help to clarify ambiguities and provide greater specificity on key compliance issues facing covered businesses and their service providers. Just last week we reported on CCPA amendment, AB 1281, which extended exemptions for “B2B” and employee personal information. We will continue to update on CCPA and other related developments as they unfold.