November 7, 2019 – The California Attorney General released the highly anticipated draft regulations for the California Consumer Privacy Act (CCPA).
The regulations focus heavily on three main areas: 1) notices to consumers, 2) consumer requests and 3) verification requirements.
While the regulations focus heavily on these three topics, they also discuss special rules for minors, non-discrimination standards and other aspects of the CCPA. Despite high hopes, the regulations do not provide the clarity many companies desired. Instead, the regulations layer on new requirements while sprinkling in further ambiguities.
The most surprising new requirements proposed in the regulations include:
- New disclosure requirements for businesses that collect personal information from more than 4,000,000 consumers.
- Businesses must acknowledge the receipt of consumer requests within 10 days.
- Businesses must honor “Do Not Sell” requests within 15 days and inform any third parties who received the personal information of the request within 90 days.
- Businesses must obtain consumer consent to use personal information for a use not disclosed at the time of collection.
The new draft regulations can be seen in their entirety at https://oag.ca.gov/news/press-releases/attorney-general-becerra-publicly-releases-proposed-regulations-under-california
