Last month, the California AG released Version 2 of its proposed CCPA regulations. Version 2 made significant changes to the original draft released last October. Yesterday, the AG released Version 3 of the proposed regulations. This round of edits consists primarily of minor clarifications and text clean-up; however, the following changes are noteworthy:
- Point of Collection Disclosures for Indirect Collections. The regulations readopt the clarification from Version 1, which was missing in Version 2, that a business need not provide a point of collection disclosure when it collects personal information from a source other than the consumer.
- Definition of Personal Information. The regulations remove the guidance from Version 2 that data, including an IP address, is not personal information if a business cannot reasonably associate it with a specific consumer or household. The definition of personal information still requires data to be reasonably associated with a consumer or household, so this change likely says more about the specific example (IP addresses) than anything else.
- Right to Know Requests. The regulations clarify that, when a business suppresses sensitive personal information from a Right to Know report, it must inform the consumer “with sufficient particularity” the type of information it collected.
- Optional Opt-Out Button. The regulations strike the section related to the optional opt-out button for Do Not Sell requests.
Interested parties may submit comments on Version 3 of the regulations until 5:00PM Pacific Time on March 27, 2020.
Nick is a Partner at M&S where he leads the firm’s Compliance practice areas. He brings more than a decade of experience helping clients understand and comply with federal and state privacy, advertising, and telemarketing laws and regulations.