LEX VINI

Updated CCPA Regulations Published

The California Department of Justice has published updated proposed regulations implementing the California Consumer Privacy Act (CCPA).  The revised regulations can be viewed here.  A comment period on the proposed regulations is open, with comments due on February 25, 2020.  The official notice, with instructions on how to comment, can be found here.

Among the notable changes in the proposed regulations, the updated proposal simplifies the required privacy policy and notice of collection contents, removing provisions from the original proposal that required identifying the business purposes and sources for each category of information collected.  Instead, a business only needs to provide the sources and purposes of information as a whole, not for each category individually.  The regulations have also removed the requirement of an interactive webform to submit “requests to know,” easing implementation for those that do not sell personal information.

The revised regulations also clarify that the collection of an IP address is not personal information if that IP address cannot reasonably be linked with a particular consumer or household, easing compliance for tools that track only IP addresses.

The revised regulations have also added significant requirements as well. For the first time, they specifically require that notices under the CCPA follow industry standards for accessibility, and incorporate the Web Content Accessibility Guidelines, version 2.1.  The regulations also more clearly require that privacy policies provide instructions on how an authorized agent can make requests on consumers’ behalf.

The regulations have also revealed the “Do Not Sell My Info” button, which can be expected to become ubiquitous:

Leave a Reply

*