Additional CCPA Regulations Finalized

The California consumer privacy landscape has shifted once again, as California Attorney General (AG) Xavier Becerra announced on March 15, 2021, that California’s Office of Administrative Law approved additional implementing regulations under the California Consumer Privacy Act of 2018 (CCPA).

The final regulations reflect minimal changes to AG Becerra’s proposed regulations of December 10, 2020 (see our earlier client alert for a comprehensive summary of the proposed regulations), with few exceptions:

• Opt-Out “Icon.” Section 999.306(f) of the final regulations depicts the below opt-out icon (the proposed regulations referred to it as an opt-out button) that a business that sells personal information may post online in addition to its required opt-out notice and “Do Not Sell My Personal Information” link. AG Becerra’s press release explicitly describes the icon as optional and includes a link by which businesses may download a .png image of the icon:
  

  

  In a departure from the proposed regulations, the final regulations eliminate a requirement that the icon appear to the left of, and link to the same online web page as, a business’ “Do Not Sell My Personal Information” link. However, like their predecessor, the final regulations require a business that utilizes the icon to make it approximately the same size as any other icons that the business uses on its webpage.

The other provisions that the final regulations introduce or amend—pertaining to offline opt-out notices, the prohibition on so-called “dark patterns” that subvert or impair a consumers’ choice to opt out, verification of authorized agents who submit requests on consumers’ behalf, and required notices to minor consumers—are all unchanged from the AG’s proposed regulations.