CCPA Regulations Update and the Opt-Out Icon Has Arrived

The Opt-Out Icon Has Arrived

Past versions of the CCPA Regulations have attempted to introduce an opt-out icon to accompany the “Do Not Sell My Personal Information” link, which is required for businesses that sell personal information under the CCPA. While previous versions of the opt-out icon were introduced and then disappeared, this time, the opt-out icon appears here to stay.
 

Clarifications and Examples in the Updated CCPA Regulations

The CCPA Regulations are updated with clarifications and examples on the following:

Inform Consumers How to Opt-Out of the Sale of Personal Information in Offline Contexts

Businesses that sell personal information must inform consumers of their right to opt-out in offline settings. For example, businesses must inform consumers of their right to opt-out on paper forms that collect personal information or via signage to where the opt-out information can be found online.

Opt-Out Shall be Easy for Consumers to Exercise

Methods for submitting requests to opt-out of the sale of personal information must be “easy” and require minimal steps. The CCPA Regulations clarify that the method should not be designed with the purpose or substantial effect of impairing a consumer’s right to opt-out. For example, opting-out should not require more steps than opting-in to the sale of personal information. Additionally, consumers should not be required to click through or listen to reasons why they should not submit an opt-out request.

Authorized Agents

Consumers using authorized agents to submit requests to know or requests to delete may be required to verify their own identity directly with the business. Alternatively, businesses may require these consumers to directly confirm with the business that they provided the authorized agent permission to submit the request. Authorized agents may also be required to provide proof that the consumer gave the authorized agent signed permission to submit the request.

Privacy Policies for Businesses that Have Actual Knowledge of Selling Personal Information of Consumers Under 13 and/or Personal Information of Consumers 13-16

Businesses that have actual knowledge of selling personal information of consumers under 13 and/or the actual knowledge of selling personal information of consumers between 13 and 16 years of age must include a description of the opt-in process in their privacy policies.

What To Do

Businesses, particularly those that sell personal information, should review the latest clarifications to the CCPA. The opt-out icon can be downloaded here and these latest amendments to the CCPA Regulations can be found here.