Client Alert

Additional CCPA Regulations Finalized

17 Mar 2021

The California consumer privacy landscape has shifted once again, as California Attorney General (AG) Xavier Becerra announced on March 15, 2021, that California’s Office of Administrative Law approved additional implementing regulations under the California Consumer Privacy Act of 2018 (CCPA).

The final regulations reflect minimal changes to AG Becerra’s proposed regulations of December 10, 2020 (see our earlier client alert for a comprehensive summary of the proposed regulations), with few exceptions:

  • Opt-Out “Icon.” Section 999.306(f) of the final regulations depicts the below opt-out icon (the proposed regulations referred to it as an opt-out button) that a business that sells personal information may post online in addition to its required opt-out notice and “Do Not Sell My Personal Information” link. AG Becerra’s press release explicitly describes the icon as optional and includes a link by which businesses may download a .png image of the icon:

    do not sell personal information

    In a departure from the proposed regulations, the final regulations eliminate a requirement that the icon appear to the left of, and link to the same online web page as, a business’ “Do Not Sell My Personal Information” link. However, like their predecessor, the final regulations require a business that utilizes the icon to make it approximately the same size as any other icons that the business uses on its webpage.

The other provisions that the final regulations introduce or amend—pertaining to offline opt-out notices, the prohibition on so-called “dark patterns” that subvert or impair a consumers’ choice to opt out, verification of authorized agents who submit requests on consumers’ behalf, and required notices to minor consumers—are all unchanged from the AG’s proposed regulations.



Unsolicited e-mails and information sent to Morrison & Foerster will not be considered confidential, may be disclosed to others pursuant to our Privacy Policy, may not receive a response, and do not create an attorney-client relationship with Morrison & Foerster. If you are not already a client of Morrison & Foerster, do not include any confidential information in this message. Also, please note that our attorneys do not seek to practice law in any jurisdiction in which they are not properly authorized to do so.