The California Attorney General’s Office (OAG) has released a third iteration of draft regulations to implement the “California Consumer Privacy Act” (CCPA) (AB 375) and is accepting comments by email or U.S. mail until 5:00 pm PDT on March 27 (See here for a clean copy and here for a redline.)Of course, the CCPA requires that regulations be in place by July 1, 2020.
The OAG explained that it “first published and noticed the proposed regulations for public comment on October 11, 2019…[but] [o]n February 10, 2020, the Department gave notice of modifications to the proposed regulations, based on comments received during the 45-day comment period.” The OAG stated that it “received around 100 comments in response to the modifications…[and] [t]his second set of modifications is in response to those comments and/or to clarify and conform the proposed regulations to existing law.”
Most of the changes are marginal. However, there a few notable modifications. Among the notable deletions, the OAG removed the section with an illustration on what an acceptable opt-out toggle button might look like. Additionally, the revised draft regulations strike the section that clarifies what could qualify as “personal information” that triggers many of the responsibilities and obligations under the CCPA.
- the categories of sources from which the personal information is collected. The categories shall be described in a manner that provides consumers a meaningful understanding of the information being collected.
- the business or commercial purpose for collecting or selling personal information. The purpose shall be described in a manner that provides consumers a meaningful understanding of why the information is collected or sold.