Final CCPA Regulations Approved and Effective Immediately

The Office of Administrative Law (OAL) approved the final implementing regulations under the California Consumer Privacy Act of 2018 (CCPA) on August 14, 2020. The approved regulations go into effect immediately.

The immediate effectiveness of the final regulations, which is somewhat unusual, reflects the fact that the OAL chose to honor California Attorney General (AG) Xavier Becerra’s request for the regulations to take effect when filed with the California Secretary of State, rather than later in the fall. The regulations were filed with the California Secretary of State on the same day they were approved by the OAL—August 14, 2020.

During OAL’s review process, additional revisions were made to the proposed regulations, which had been submitted to the OAL by AG Becerra on June 1, 2020. The additional revisions fall into two categories:

1. Withdrawal of provisions. The OAL withdrew certain provisions from the proposed regulations for additional consideration. The AG’s Office is allowed to resubmit these provisions after further review and possible revision. The provisions withdrawn by the OAL that are not otherwise required by the CCPA itself include:

• § 999.305(a)(5). The portion of this provision requiring a business to obtain explicit consent from a consumer prior to using the consumer’s previously collected personal information for a purpose materially different than what was previously disclosed to the consumer.
• § 999.306(b)(2). The provision stating that a business that substantially interacts with consumers offline shall also provide notice of the right to opt out by an offline method that facilitates consumer awareness of the right to opt out.
• § 999.315(c). The provision requiring a business’s methods for submitting requests to opt out to be easy for consumers to execute and require minimal steps to allow the consumer to opt out.
• § 999.326(c). The provision stating that a business may deny a request from an authorized agent that does not submit proof that they have been authorized by the consumer to act on their behalf.

2. Clarifying revisions. The OAL made what it defined as “non-substantive” changes for accuracy, consistency, and clarity. The OAL stated in its Addendum to the Final Statement of Reasons that it does not consider these non-substantive changes to materially alter the requirements, rights, responsibilities, conditions, or prescriptions contained in the original proposed regulations.

For additional information and guidance, please visit our CCPA Resource Center.