With less than 45 days to go until the most significant state privacy law in U.S. history takes effect, the California Consumer Privacy Act (“CCPA”) remains a moving target. Companies looking to influence the course of CCPA have an opportunity to do so over the next two weeks, as the California Attorney General accepts comments and holds hearings on its proposed CCPA regulations.

Despite two rounds of amendments by the California legislature, CCPA remains a somewhat bare-bones statute. The regulations would put meat on the bones. They will provide important details on how, exactly, companies are supposed to provide consumer notifications. They also spell out how companies should respond to “verifiable consumer requests” for access to their data, respond to consumer requests for data deletion, and provide “Do Not Sell” options for consumers looking to avoid third-party use of their data. Verification of the identities of consumers who submit such requests is also addressed in the draft regulations.

Before releasing the proposed CCPA regulations, the Attorney General’s Office received comments—now available online—from companies like Genentech and Mastercard, from prominent law firms, and from trade groups like the Alliance of Auto Manufacturers and the American Financial Services Association. The thrust of many of the comments, broadly speaking, was the need to clarify CCPA’s many vague provisions to make the path to compliance clearer. For example, comments sought additional clarification as to what constituted a “verifiable consumer request.” Other comments requested clarification of and expansions to CCPA’s various exemptions, such as the exemption for data covered by the Gramm-Leach Bliley Act.

The public comment period remains open through December 6, 2019 at 5:00 p.m. PST. Comments can be submitted by email to PrivacyRegulations@doj.ca.gov, or by postal mail to:

• Privacy Regulations Coordinator
  California Office of the Attorney General
  300 South Spring Street, First Floor
  Los Angeles, CA 90013

The Attorney General’s guidelines provide that interested parties should clearly cite the portion of the regulations on which they are commenting; support comments with information and sound reasoning; respond to possible opposing viewpoints; and propose alternative text that would better balance the interests of all.

The California Attorney General will also hold four public hearings at which any interested parties will have the opportunity to present, either orally or in writing, statements or comments regarding the proposed regulations. These hearings will be held on December 2, 2019 in Sacramento, CA; December 3, 2019 in Los Angeles, CA; December 4, 2019 in San Francisco, CA; and December 5, 2019 in Fresno, CA. The hearings will be recorded and made available online. Additional details can be found at https://oag.ca.gov/privacy/ccpa.

Meanwhile, compliance planning continues across the private sector. In a widely publicized development, Microsoft announced last week that it will voluntarily extend CCPA’s “core rights” to all U.S. consumers. This “everyone’s a Californian” approach prioritizes the operational simplicity and consumer trust benefits of treating everyone alike. It also anticipates possible adoption of CCPA-like laws in other states or at the federal level.

CCPA poses particular challenges for digital media and advertising companies. The Interactive Advertising Bureau has created a CCPA Compliance Framework for Publishers and Technology Companies. The Digital Advertising Alliance is similarly developing compliance tools.

We invite clients and friends to join us Tuesday, November 19 for a webinar, Are You Ready for CCPA? Details and an RSVP opportunity are at the link.