The California Attorney General’s office announced a fourth set of proposed modifications to the CCPA regulations. These modifications: (1) clarify the requirement for businesses that sell personal information that is collected offline to provide offline opt-out notices; and (2) propose an opt-out button for businesses to feature online along with opt-out notices and the “Do Not Sell My Personal Information” link.

Clarifying offline opt-out notice requirements. The modifications proposed in October required that any business that collected personal information offline provide notice via an offline method of the consumer’s opt-out right.

The modified regulations now specify that businesses that sell personal information that they collect “in the course of interacting with consumers offline” must provide an offline notice of the consumer’s right to opt-out, and provide instructions for how the consumer can opt out.
The same examples of providing notice on a paper form, posting a sign in a store, or giving an oral notice over the phone still apply.

While not explicitly stated in the proposal, this modification suggests that businesses that collect personal information offline, but do not sell that personal information, are not required to provide an offline opt-out notice, even if the business separately sells personal information that it collects online. In response to the October proposal, numerous comments indicated that requiring an opt-out notice when the business did not sell information collected offline could potentially confuse consumers.

Proposing an optional opt-out button. After delaying the introduction of the opt-out button in the first set of CCPA regulations, the Attorney General’s office has proposed the following blue button for businesses to use in addition to providing an opt-out notice and “Do Not Sell My Personal Information” link:

Use of the button does not absolve a business from posting the opt-out notice or link where otherwise required. Where a business posts a “Do Not Sell My Personal Information” link, the business must also include the button to the left of the link (as shown above) in “approximately the same size as any other buttons used by the business on its webpage.” The button must link to the same landing page as the “Do Not Sell My Personal Information” link itself.

Process and Timing. The deadline to submit written comments to the proposed modifications is 5:00 PM PST on December 28, 2020. The regulations have been a continued work in progress for the Attorney General’s office since their first publication in October 2019. We will continue to monitor any further changes and will provide updates on the blog.

_________________________

Hear Alysa Hutnik and Aaron Burstein discuss some of the overarching CPRA issues and a few particular issues that caught their attention on the Ad Law Access podcast.

Listen on Apple, Spotify, Google Podcasts, SoundCloud, via your smart speaker, or wherever you get your podcasts.

CCPA Update: California AG Proposes Fourth Set of Changes to CCPA Regulations