State Regulatory Developments

California Amends CCPA Regulations

California’s regulations implementing the California Consumer Privacy Act (CCPA) were recently amended, effective March 29, 2023.  The amendments: (i) update required disclosures to consumers; (ii) expand business, service provider, contractor, and third-party obligations for handling consumer information; and (iii) establish new investigation and enforcement procedures.

Other changes include:

  • new restrictions on a business’s collection, use, retention, or sharing of consumers’ personal information;
  • requirements for disclosures and communications to consumers;
  • requirements concerning the methods by which businesses submit CCPA requests and obtain consumer consent;
  • updates to required disclosures to consumers from businesses that collect and control consumer information;
  • revisions to privacy policy requirements;
  • revisions to the Notice at Collection of consumers’ personal information;
  • revisions to the Notice of Financial Incentive;
  • rules concerning requests to correct and the methods for submitting requests to delete, correct and know, including revisions to the timelines for responding to such requests;
  • revising requirements for requests to opt-out of sale/sharing, including requiring opt-out preference signals;
  • permitting requests to limit the use and disclosure of sensitive personal information;
  • expanding requirements for service providers, contractors, and third-party use of consumer information; and
  • establishing new provisions for the California Privacy Protection Agency to conduct investigations of alleged violations of the CCPA.