California Amends CCPA Regulations on Opt-Out of Sale of Personal Info
California recently amended its regulations governing compliance with the California Consumer Privacy Act’s (CCPA) provisions concerning the right to opt out of the sale of personal information. The revisions were effective March 15, 2021.
The CCPA and its implementing regulations require, among other provisions, that companies who sell personal information of consumers provide consumers with notice regarding their right to opt-out of the sale of their information. The changes extend this requirement to companies that sell personal information they collect from consumers through offline interactions. This includes, but is not limited to, companies that collect personal information from brick-and-mortar stores or over the phone. Such companies are now required to inform consumers of their right to opt-out in an offline method that is consistent with their method of acquiring personal information.
The amendments also require the methods for submitting opt-out requests to be easy and to contain minimal steps. Methods that subvert or impair a consumer’s choice to opt-out are prohibited. The following factors may be considered to determine whether the method is subversive or impairing:
- The process to opt-out of the sale of personal information has more steps than the process to opt-in after a consumer has previously opted out;
- The use of confusing language, such as double negatives; or
- The process asks for personal information that is not necessary to process the opt-out request.
The amendment also introduces an optional Opt-Out Icon for companies to use on their websites, which does not displace other posting requirements.
WBK previously covered the proposal here.
