Skip to Content

The Final CCPA Regulations May Be Ready, But Is Your Business?
August 19, 2020
After what seemed like a set of fits and starts for the California Consumer Privacy Act (CCPA), which went into effect on January 1, 2020, California Attorney General Xavier Becerra announced the approval of the final regulations for the CCPA on August 14, 2020. While enforcement of the CCPA began on July 1, 2020, the absence of final regulations had many businesses and lawyers wondering if the final regulations would contain any substantive changes.

Not surprisingly, beyond the expected grammatical and linguistic changes, a few key highlights emerged:

  • Consent Not Required for Materially Different Use of Information: The final regulations no longer require businesses to obtain consent before using personal information for materially different purposes other than those disclosed at the time of collection.
  • Use "Do Not Sell My Personal Information": The final regulations demonstrate that there is no flexibility for how businesses must signal to consumers how they can opt out of the sale of their personal information. Businesses must use the language "Do Not Sell My Personal Information" in the opt-out link.
  • Offline Notice Set Aside: The final regulations no longer require businesses that "substantially" interact with consumers offline to also provide notice to those consumers about their rights through paper notices, signage, or on paper receipts.
  • No More "Easy" Opt Out: The final regulations no longer mandate that businesses make their methods for opting out of the sale of personal information "easy" or that "minimal steps" be required.

The changes that emerged in the final regulations may appear to be advantageous to businesses, but should not be mistaken for a suggestion that the attorney general's office will be lax in its enforcement of the CCPA. Additionally, businesses must continue to be aware of their obligations under federal law to provide appropriate notice and obtain requisite consents. And, as always, a good rule of thumb with California legislation: there could always be more changes.

While some businesses may be satisfied that the "rules of the road" are firmly established, the finalization of the CCPA regulations may not be the end of privacy regulation in California. There are several amendments to the CCPA pending before the California Legislature.

Also, on June 24, 2020, the California Privacy Rights Act (CPRA) qualified as an initiative for the November 3, 2020, election. If passed, the CPRA, also referred to as "CCPA 2.0," would create a host of additional compliance obligations for businesses, applying to any information collected after January 1, 2022. Businesses would have until January 2023 to come into compliance.

With the uncertainty of COVID-19, the lack of final CCPA regulations may have precipitated a stall or slowing of compliance for your business. But make no mistake: enforcement is underway and is expected to increase.

Carlton Fields is hosting a webinar to discuss what businesses can do now to demonstrate or ramp up CCPA compliance, CCPA litigation developments, and the impact of the decision by the Court of Justice of the European Union in Schrems II, on August 25, 2020, at 12 p.m. PT / 3 p.m. ET.

Join us and register.
Related Practices
Technology Cybersecurity and Privacy
Related Industries
Technology
©2024 Carlton Fields, P.A. Carlton Fields practices law in California through Carlton Fields, LLP. Carlton Fields publications should not be construed as legal advice on any specific facts or circumstances. The contents are intended for general information and educational purposes only, and should not be relied on as if it were advice about a particular fact situation. The distribution of this publication is not intended to create, and receipt of it does not constitute, an attorney-client relationship with Carlton Fields. This publication may not be quoted or referred to in any other publication or proceeding without the prior written consent of the firm, to be given or withheld at our discretion. To request reprint permission for any of our publications, please use our Contact Us form via the link below. The views set forth herein are the personal views of the author and do not necessarily reflect those of the firm. This site may contain hypertext links to information created and maintained by other entities. Carlton Fields does not control or guarantee the accuracy or completeness of this outside information, nor is the inclusion of a link to be intended as an endorsement of those outside sites.

Disclaimer

The information on this website is presented as a service for our clients and Internet users and is not intended to be legal advice, nor should you consider it as such. Although we welcome your inquiries, please keep in mind that merely contacting us will not establish an attorney-client relationship between us. Consequently, you should not convey any confidential information to us until a formal attorney-client relationship has been established. Please remember that electronic correspondence on the internet is not secure and that you should not include sensitive or confidential information in messages. With that in mind, we look forward to hearing from you.