The final California Consumer Privacy Act Regulations (CCPA Regs) were adopted by the California secretary of state on August 14, 2020. In an addendum released by the California attorney general (Cal. AG), the office of administrative law (OAL) notes that their changes are “non-substantive changes for accuracy, consistency, and clarity.” There are indeed no wholesale changes from the version adopted by the California attorney general in June 2020 and the final CCPA Regs released on August 14, 2020. That said, the following changes, while not altogether transformative, could nonetheless cause businesses to update their CCPA compliance programs. The key modifications in the CCPA Regs are referenced in the OAL’s Notice of Approval in Part and Withdrawal in Part of Regulatory Action and are summarized below:
Changes Pertaining to Financial Incentives
- The definition of “financial incentive” was revised to replace “retention” with “deletion,” and a financial incentive is now defined as follows: “a program, benefit, or other offering, including payments to consumers, related to the collection, deletion, or sale of personal information.” 999.301(j). The practical impact of this may not be terribly significant here because of the requirements to have a notice of financial incentive and most companies will be implicated here, if at all, in the areas of collecting or selling data rather than deletion of data.
- The Notice of Financial Incentive Section was revised to state that “a business that does not offer a financial incentive or price or service difference is not required to provide a notice of financial incentive.” 999.307(a)(1). Previously this was only relevant where the financial incentive was “related to the collection, retention, or sale of personal information.”
Notice at Collection – No Longer Requires Explicit Consent
- Section 999.305(a)(5) was deleted. This section previously provided that “a business shall not use a consumer’s personal information for a purpose materially different than those disclosed in the notice at collection. If the business seeks to use a consumer’s previously collected personal information for a purpose materially different than what was previously disclosed to the consumer in the notice at collection, the business shall directly notify the consumer of this new use and obtain explicit consent from the consumer to use it for this new purpose.” As a practical matter, the only difference is the fact that there is not a mandatory requirement to obtain “explicit” consent. Yet 1798.100(b) still calls for notice to consumers if any additional purposes will be utilized.
Opt-Out Options Are Modified Online and Offline
- References to “Do Not Sell My Info” were removed, which would imply that businesses that are selling information are now required to use the full statement “Do Not Sell My Personal Information.” As a practical matter, most companies were following the statutory requirements for “Do Not Sell My Personal Information” and this is consistent with the statutes 1798.120 and 1798.135.
- Section 999.306(b)(2) was deleted. This section previously provided that “a business that substantially interacts with consumers offline shall also provide notice to the consumer by an offline method that facilitates consumer awareness of their right to opt out. Such methods include, but are not limited to, printing the notice on paper forms that collect personal information, providing the consumer with a paper version of the notice, and posting signage directing consumers to where the notice can be found online.” As a practical matter, this might not affect many companies who are currently, due to COVID-19, interacting with California residents predominantly in a digital manner.
Request to Access or Delete Now Applies to Requests to Know or Delete
- The Section on Requests to Access or Delete Household Information was revised to apply to Requests to Know or Delete Household Information.
Severability Section Is Gone
- Section 999.341 on Severability was removed.