In announcing the proposed modifications, the OAG release a notice, available here and a comparative text of the proposed modifications, available here.
The proposed modifications include four key changes to the Regulations, which are summarized below.
Offline Opt-Out. § 999.306 was revised to include a new subsection (b)(3), which specifies that businesses collecting personal information “in the course of interacting with consumers’ offline” must also provide an opt-out notice by an offline method that “facilitates the consumers’ awareness of their right to opt out.” The proposed modifications also include two illustrative examples, including the option for brick-and-mortar stores to print the notice on the paper forms that collect personal information or by posting signage in the area where the personal information is collected directing consumers to where the notice can be found online. Additionally, a business that collects personal information over the phone can provide the opt-out notice orally during the call where personal information is collected.
Methods for Submitting Requests to Opt-Out. § 999.315 was revised to include a new subsection (h) that sets forth guidance on how a business should provide methods for consumers to submit requests to opt-out. The proposed modifications require that a business’s “methods for submitting requests to opt-out shall be easy for consumers to execute and shall require minimal steps to allow the consumer to opt-out” and that “a business shall not use a method that is designed with the purpose or has the substantial effect of subverting or impairing a consumer’s choice to opt-out.” According to the notice, the proposed modifications include illustrative examples of methods designed with the purpose or substantial effect of subverting or imparting a consumer’s choice to opt-out. The examples in the proposed modifications include:
- The business’s process for submitting a request to opt-out shall not require more steps than that business’s process for a consumer to opt-in to the sale of personal information after having previously opted out. The modifications specify that that the number of steps for submitting a request to opt-out is measured from when the consumer clicks on the opt-out link to the completion of an opt-out request while the number of steps for submitting a request to opt-in is measured from the first indication by the consumer to the business of their interest to opt-in to completion of the request.
- A business shall not use confusing language, such as double negatives (e.g., “Don’t Not Sell My Personal Information”), when providing consumers the choice to opt-out.
- A business shall not require consumers to click through or listen to reasons why they should not submit a request to opt-out before confirming their request (except as permitted by the Regulations).
- The process for submitting a request to opt-out shall not require the consumer to provide personal information that is not necessary to implement the request.
- Upon clicking the “Do Not Sell My Personal Information” link, a business shall not require the consumer to search or scroll through the text of a privacy policy or similar document or webpage to locate the mechanism for submitting a request to opt-out.
Authorized Agent Authority. § 999.326(a) was modified to clarify that a business may require that a consumer’s authorized agent provide proof that the consumer gave the agent signed permission to submit a request to know or a request to delete.
Notices to Consumers Under 16. § 999.332 was modified to clarify that a business that collects information of consumers under 13 years old and/or consumers between the ages of 13 and 15 must include a description of the process set forth in § 999.330 and § 999.331 in its privacy policy.
The OAG will accept written comments on the proposed modifications until 5:00 pm PST on October 28, 2020. We will continue to monitor developments with the Akin Gump’s enforcement of the CCPA, as well further modifications to the Regulations. If you have any questions about your company’s obligations, and compliance and risk mitigation efforts, please contact a member of the Akin Gump Cybersecurity, Privacy and Data Protection team.
