California Amends CCPA Regulations
California’s regulations implementing the California Consumer Privacy Act (CCPA) were recently amended, effective March 29, 2023. The amendments: (i) update required disclosures to consumers; (ii) expand business, service provider, contractor, and third-party obligations for handling consumer information; and (iii) establish new investigation and enforcement procedures.
Other changes include:
- new restrictions on a business’s collection, use, retention, or sharing of consumers’ personal information;
- requirements for disclosures and communications to consumers;
- requirements concerning the methods by which businesses submit CCPA requests and obtain consumer consent;
- updates to required disclosures to consumers from businesses that collect and control consumer information;
- revisions to privacy policy requirements;
- revisions to the Notice at Collection of consumers’ personal information;
- revisions to the Notice of Financial Incentive;
- rules concerning requests to correct and the methods for submitting requests to delete, correct and know, including revisions to the timelines for responding to such requests;
- revising requirements for requests to opt-out of sale/sharing, including requiring opt-out preference signals;
- permitting requests to limit the use and disclosure of sensitive personal information;
- expanding requirements for service providers, contractors, and third-party use of consumer information; and
- establishing new provisions for the California Privacy Protection Agency to conduct investigations of alleged violations of the CCPA.
