On December 10, 2020, the CA Attorney General released the Fourth Set of Proposed Modifications to the California Consumer Protection Act (CCPA) Regulations, styled as “Modifications to Proposed Modifications.” In the Third Set, the proposed changes mainly focused on the consumer right to opt-out of the sale of one’s personal information and the ability to understand and exercise those rights. In this Fourth Set, the revisions clarify ambiguities and provide additional guidance promoting a uniform rollout of “Do Not Sell” opt-out button.
Some of the other notable changes are listed below:
- Clarifying the Authorized Agent Provisions. The Third Set clarifies an ambiguity that existed in section 999.326(a) of the Final Regulations, which describe how a consumer can use an authorized agent to submit requests to know or delete on their behalf. The Final Regulations state at subsection (a) that “When a consumer uses an authorized agent to submit a request to know or a request to delete, a business may require that the consumer do the following[…][,]” (emphasis added). The business is then allowed to require the consumer to: (1) provide proof they had provided the agent signed permission to act on their behalf, (2) provide verification of their own identity with the business, or (3) provide direct confirmation that the agent is authorized to act on their behalf. The Third Set proposes striking the first requirement and instead allow the authorized agent to provide “proof that the consumer gave the agent signed permission to submit the request.” While this is likely to make it somewhat easier for authorized agents to act on behalf of the consumers they serve, the Third Set still provides that businesses may require that the consumer directly confirm both the identity and authorization for the agent to act on their behalf vis-a-vis the business.
- Promoting a Uniform “Opt-Out Button.” The only completely new provision in the Fourth Set is a new subsection for section 999.306, which describes the “Notice of a Right to Opt-Out of Sale of Personal Information.” The new subsection (f) describes the “Opt-Out Button” and clarifies that an actual button “may be used in addition to . . . but not in lieu of any requirement to post the notice to opt-out” or a “Do Not Sell” link. The provision provides examples of an opt-out button which may be used and provides other specifications, like the button “shall be added to the left side” of the “Do Not Sell” link and that it should be “approximately the same size as any other buttons” used by the site.