posted by

CCPA regulations. The fourth set of proposed modifications

Following previous modifications in October 2019, and in February and March 2020, the latest updates landed in December, delivered by the California Department of Justice.

CCPA regulations. The fourth set of proposed modifications

Each set of the previous modifications results from taking account of, and action on, the comments made to each of the developments in the earlier sets.

This latest, fourth set of modifications is primarily concerned with:

1. The right to opt-out

The proposed modifications concerning the right to opt-out are concerned with businesses selling personal information gathered in offline situations.

The new regulation dictates that companies should provide an opt-out of selling personal data in that same situation.

It delivers strong examples here—if the data is gathered during a phone call, the call must include dialogue that makes the subject aware that their data may be sold and an opportunity to opt-out from its selling. In this situation, the opt-out is verbal, as is the rest of the conversation and its arrangements and agreements.

The same must be provided then, in written arrangements, verbal methods in other situations (face-to-face, in-store, or video calling, for example), and during any other offline method.

2. The re-introduction of a company opt-out button

The use of an opt-out button looks to have been standardized by introducing a uniform logo that all companies should use when implementing the option. There are supporting instructions relevant to its use—once again, to keep the system standardized across the market.

An opt-out button was included in the first set of the CCPA regulation modifications, yet was removed due to negative feedback.

CCPA regulations. Opt-out button regulation updates

The following paragraphs were added to create a new section of the regulations, the first covers a smaller simple blue coloured tick/cross image, and the second the same image with the Do Not Sell My Personal Information wording to its right-hand side:

  1. May be used in addition to posting the notice of right to opt-out, but not in lieu of any requirement to post the notice of right to opt-out or a ‘Do Not Sell My Personal Information’ link as required by; and
  2. Where a business posts the ‘Do Not Sell My Personal Information’ link, the opt-out button shall be added to the left of the text demonstrated below. The opt-out button shall link to the same Internet webpage or online location to which the consumer is directed after clicking on the ‘Do Not Sell My Personal Information’ link.
  3. The button shall be approximately the same size as any other buttons used by the business on its webpage.

3. Processing consumers requests to opt-out

The final modification includes instruction into streamlining the opt-out process as much as possible.

This subsection details that the method to opt-out should be just as simple as opting in, with no additional steps included in the process. Both options should contain the same number of steps in their process.

Comments to modifications closed on December 28th 2020.

For the full set of changes and modifications can be viewed here.