Keypoint: The California Attorney General's office again introduces an opt-out button.
On December 10, 2020, the California Attorney General's office published a fourth set of proposed modifications to the California Consumer Privacy Act (CCPA) regulations. The deadline to submit comments to the proposed modifications is Monday, December 28, 2020.
The latest set of proposed modifications are revisions to the office's third set of proposed modifications, published on October 12, 2020. The deadline to submit comments to the third set of modifications passed on October 28, 2020. For a discussion on the third set of modifications, see our prior blog post available here.
The primary change in the fourth set of proposed modifications is the re-introduction of an opt-out button. The Attorney General's office initially proposed an opt-out button in its First Modified Regulations in line with § 1798.185(a)(4)(C) of the CCPA, which required the Attorney General's office to adopt regulations "[f]or the development and use of a recognizable and uniform opt-out logo or button by all businesses to promote consumer awareness of the opportunity to opt-out of the sale of personal information." However, after privacy advocates objected to the button, the office subsequently deleted the button in its Second Modified Regulations published on March 11, 2020.
§ 999.306(f) Opt-Out Button
The modifications would add a new section (f) to this regulation section, stating that an opt-out button "may be used in addition to posting the notice of right to opt-out, but not in lieu of any requirement to post the notice of right to opt-out or a 'Do Not Sell My Personal Information' link as required by" §1798.135 and the regulations. In turn, § 999.306(f)(2) states: "Where a business posts the 'Do Not Sell My Personal Information' link, the opt-out button shall be added to the left of the text demonstrated below. The opt-out button shall link to the same Internet webpage or online location to which the consumer is directed after clicking on the 'Do Not Sell My Personal Information' link."
§ 999.306(b)(3) Notice of Right to Opt-Out of Sale of Personal Information
The modifications would tweak the language in § 999.306(b)(3) to clarify that a "business that sells personal information that it collects in the course of interacting with consumers offline shall also inform consumers by an offline method of their right to opt-out and provide instructions on how to submit a request to opt out." The regulation provides the following illustrative examples:
- A business that sells personal information that it collects from consumers in a brick-and-mortar store may inform consumers of their right to opt-out on the paper forms that collect the personal information or by posting signage in the area where the personal information is collected directing consumers to where the opt-out information can be found online.
- A business that sells personal information that it collects over the phone may inform consumers of their right to opt-out orally during the call when the information is collected.
It is important to note that the latest round of proposed modifications incorporate other changes that were proposed in the third set of modifications. In addition to the changes discussed above, the California Attorney General's office also is still proposing to add § 999.315(h), which provides further instructions on opt-out requests, and modify the language in § 999.326, concerning authorized agent requests.
As noted, the deadline to submit comments to the latest set of proposed modifications is Monday, December 28, 2020.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.