On June 1, 2020, the Office of the California Attorney General submitted final regulations under the California Consumer Privacy Act (“CCPA”) to the California Office of Administrative Law (“OAL”) for expedited review.
Generally, a new California regulation takes effect on October 1, if the regulation is filed with the California Secretary of State between June 1 and August 31 of each calendar year. The current submission, however, requests that the final CCPA regulations take effect upon their filing with the Secretary of State. OAL has 30 working days, plus an additional 60 calendar days, to review the package for procedural compliance with California’s Administrative Procedure Act. The end result is that the submitted regulations could take effect on July 1, 2020, which is when the Attorney General’s Office has announced that it intends to begin its enforcement of the CCPA.
The final rules remain largely unchanged from the most recent version of proposed regulations, which were released this past March. Among other things, the final regulations confirm that a business does not need to provide notice to consumers at or before the point at which the business collects consumers’ personal information, if the business does not collect information directly from consumers and does not sell that information. Additionally, the final regulations confirmed the deletion of the “do not sell my information” slider, which is called out in the CCPA statutory language but not yet addressed in the regulations. (The first version of the regulations included a graphic form of the slider to allow consumers to opt out of the sale of their personal information, but the last round of revisions and the final regulations have taken the slider out, leaving an important gap in the regulatory guidance on this issue.)
Given the possibility for expedited applicability of the new regulations, companies should immediately assess their compliance with CCPA and the final regulations before the Office of the California Attorney General begins enforcement actions. Doing so not only lets companies appropriately structure how they collect, maintain, and use data, but also will prepare them for the California Privacy Rights Act of 2020 (“CPRA”)—which will likely be on the November 2020 ballot—that would amend CCPA to create new and additional privacy rights and obligations.