On August 14, 2020, the Attorney General’s California Consumer Privacy Act (CCPA) Regulations were approved by the Office of Administrative Law (OAL) and immediately went into effect. If CCPA applies to your business, this is something you cannot ignore.
For many, this was an unexpected development. Most regulations become effective on one of four quarterly dates based on when the final regulations are filed with the Secretary of State. Typically, if final regulations are filed with the Secretary of State between June 1 and August 31, they would not take effect until October 1. But here, the Attorney General requested an earlier effective date and expedited review of the regulations, citing that the text of the CCPA required the Attorney General to adopt regulations by July 1, 2020. The OAL granted this request.
However, the OAL’s approval of the CCPA regulations did not come in blanket form. In addition to many non-substantive changes, which is common for the rulemaking process, there were some substantive changes as well. In particular, four narrow subsections in the Attorney General’s proposed regulations were withdrawn from OAL review. The sections are as follows:
1. 999.305(a)(5) requiring businesses to obtain express consent from consumers before using previously collected information for a materially different purpose;
2. 999.306(b)(2) requiring businesses substantially interacting with consumers offline to provide notice of right to opt-out via an offline method;
3. 999.315(c) establishing minimum standards for submitting requests to opt-out to businesses;
4. 999.326(c) providing businesses with the ability to deny certain requests from authorized agents;
Before the pandemic shut-down our economy, we wrote about the need to delay enforcement of CCPA regulations until January 1, 2021. Now, amid the pandemic and months into this crisis, the August 14 approval and immediate enforcement date comes as sort of a surprise for many businesses. But as we saw with CCPA enforcement, which began on July 1, the AG seems to initiate actions with a notification of violation and corresponding 30-day opportunity to cure (NOVs). This is encouraging because it allows businesses to engage-with the Attorney General’s office and resolve any issues before the need to defend a formal action. This moderate approach will help many struggling businesses in our State.