Approved CCPA Regulations and Appointees to CPRA Privacy Protection Agency

Written by: Brett Lawrence, Esq.

1. CCPA Regulations

Effective as of March 15, 2021, California’s Office of Administrative Law approved additional California Consumer Privacy Act (“CCPA”) regulations. The regulations provide the following:

• • • Offline Notification. Any business who sells personal information of a consumer that has been collected “offline” must provide proper consumer notification through an offline method, such as posting signage on the business’s door.

• • • Opt-Out Icon. Businesses can utilize an opt-out icon (example provided in the regulations) in addition to posting the notice of consumers’ right to opt-out.

• • • Easy Opt-Out Method. Businesses must make it “easy” for consumers to opt-out of their personal information being sold without subverting their rights under CCPA. This can include avoiding unnecessary text and confusing language.

• • • Authorized Agent. Authorized agents can now provide proof that they are acting on the consumer’s behalf.

2. Appointees for the California Privacy Protection Agency

On March 17, 2021, five experts in the field of privacy, technology, and consumer rights were appointed as board members to lead the newly‑established California Privacy Protection Agency (“CPPA”). These members will possess rulemaking and enforcement authority under the California Privacy Rights Act (“CPRA”), the ballot initiative approved by California voters last November. The CPPA will issue regulations on a host of issues required under the CPRA. Final regulations must be adopted by July 1, 2022.