California's Attorney General Releases Proposed Regulations under the CCPA

On Oct. 10, 2019, California's attorney general released the text of proposed regulations implementing the California Consumer Privacy Act (CCPA), California's groundbreaking new privacy law that will soon impact businesses across the United States. He also issued a Notice of Proposed Rulemaking Action and an Initial Statement of Reasons corresponding to the proposed regulations.

The 24 pages of proposed regulations contain much-anticipated guidance on how the CCPA will be interpreted and enforced by the AG, including definitions of key terms such as "household" and "service provider"; rules about the form and content of consumer notice; requirements for handling consumer requests under the CCPA, such as record-keeping obligations; special protections for minors; and further guidance on nondiscrimination under the CCPA.

As currently written, the proposed regulations would significantly impact businesses that are working to be able to comply with the CCPA. For example, they impose specific notice and consumer-request-handling obligations for businesses that "substantially" or "primarily" interact with consumers in person, such as with brick-and-mortar retail stores. The proposed regulations contain a rule requiring that a business that receives a consumer's request to opt out of data sales must notify all third parties to which the business has sold that consumer's information over the last 90 days and direct them not to further sell the consumer's information. Third-party identity verification services could be used to verify the identity of individuals making requests to know or delete information, and businesses would be required to maintain records of requests under the CCPA and their responses for at least 24 months.

Finally, the proposed regulations make clear that, in general, practices that treat consumers differently for exercising a right under the CCPA or the regulations would be considered discriminatory and prohibited. The illustrations offered to show what would be permitted or prohibited include a music streaming service providing different rights to free users versus paying users, and retail stores offering discounts to customers who sign up for mailing lists. Price and service differences in exchange for data sharing would be allowed, but only if they "reasonably relate to the value of the consumer's data." The proposed regulations go on to specify the methods by which businesses could calculate this value.

The proposed regulations are expected to become final following a period for public comment. Interested parties may submit written comments to the AG by email or mail, or participate in public hearings scheduled throughout California at the beginning of December. The deadline for written comments is Dec. 6, 2019.

For more information on the CCPA and how it could affect your business, please contact a member of Robinson Bradshaw's Cybersecurity and Privacy Practice Group.