skip to main content

March 12, 2020

Stroock Special Bulletin

By: Stephen J. Newman, Quyen T. Truong, Ali Fesharaki

On March 11, 2020, the California Attorney General’s Office (AG) announced a second set of modifications to its proposed regulations implementing the California Consumer Privacy Act (CCPA). There are far fewer and less substantive revisions in what now marks the third version of the AG’s proposed regulations, suggesting that the AG may be close to finalizing its rules. A redline tracking changes against both the initial draft regulations (issued October 11, 2019) and the first modified draft (issued February 10, 2020) is available here.

The most significant modification is perhaps the withdrawal of the AG’s guidance regarding the interpretation of CCPA definitions. As reported in Stroock’s prior bulletin, the AG previously proposed adding guidance to clarify that whether data constitutes “personal information” under the CCPA depends on how a business maintains that information – that is, even if the data technically met the CCPA’s definition, it would not be deemed “personal information” if the business did not and could not reasonably link that data to a particular consumer or household. While the AG has not published an official reason for the withdrawal of such guidance from its proposed regulations, the change perhaps reflects the AG’s preference to allow the courts to interpret the definition of “personal information” in the first instance.

Another notable change is the removal of provisions outlining specifics for use of the “button” or “logo” pertaining to consumers’ right to opt out of the sale of their personal information. Recall that in its prior version of the regulations, the AG had proposed a specific, uniform “opt out” red button or toggle switch with a “Do Not Sell My Information” logo, which was to be placed on a website landing page. However, the other provisions pertaining to consumers’ right to opt out of the sale of their data remain intact.

The AG is providing a short window for written comments, setting March 27, 2020, as the submission deadline.

Stroock’s Privacy/CCPA Team will continue to report on the latest developments. Our Team has closely monitored California’s evolving privacy framework since the introduction of the first ballot initiative. Our work ranges from building pragmatic compliance systems for small businesses to defending global industry leaders against government and private actions, including one of the first complaints filed within weeks of the CCPA’s January 1, 2020, effective date. Click here to learn more about Stroock’s Privacy/CCPA capabilities, and click here for a recording of our January 23, 2020, webinar, “Charging into the New Decade: A Look at California’s Expansive Regulatory Moves.”

______________________________

For More Information

Stephen J. Newman

Quyen T. Truong

Ali Fesharaki

This Stroock publication offers general information and should not be taken or used as legal advice for specific situations, which depend on the evaluation of precise factual circumstances. Please note that Stroock does not undertake to update its publications after their publication date to reflect subsequent developments. This Stroock publication may contain attorney advertising. Prior results do not guarantee a similar outcome.