The California consumer privacy landscape has shifted once again, as California Attorney General (AG) Xavier Becerra announced on March 15, 2021, that California’s Office of Administrative Law approved additional implementing regulations under the California Consumer Privacy Act of 2018 (CCPA).
The final regulations reflect minimal changes to AG Becerra’s proposed regulations of December 10, 2020 (see our earlier client alert for a comprehensive summary of the proposed regulations), with few exceptions:
In a departure from the proposed regulations, the final regulations eliminate a requirement that the icon appear to the left of, and link to the same online web page as, a business’ “Do Not Sell My Personal Information” link. However, like their predecessor, the final regulations require a business that utilizes the icon to make it approximately the same size as any other icons that the business uses on its webpage.
The other provisions that the final regulations introduce or amend—pertaining to offline opt-out notices, the prohibition on so-called “dark patterns” that subvert or impair a consumers’ choice to opt out, verification of authorized agents who submit requests on consumers’ behalf, and required notices to minor consumers—are all unchanged from the AG’s proposed regulations.