KMK Law Cybersecurity & Privacy Blog

Those privacy professionals following the California Consumer Privacy Act (also known as the CCPA) have been eagerly awaiting final regulations from the California Attorney General (CA AG). Unfortunately, we will have to wait a little longer. On February 10, 2020, the CA AG published the Revised Proposed Regulations.[1] This means that the California public will have another opportunity to submit their comments on the CCPA regulations before the CA AG makes additional revisions. The deadline to submit written comments is February 25, 2020. From there, the CA AG has until July 1, 2020 to finalize the regulations. 

The Revised Proposed Regulations made several changes to the Initial Proposed Regulations that were published on October 11, 2019.[2] One helpful clarification is the reminder in Section 999.302(a) that each of the examples of personal information listed in the statute still “depends on whether the business maintains information in a manner that ‘identifies, relates to, describes, is reasonably capable of being associated with, or could be reasonably linked, directly or indirectly, with a particular consumer or household.’”[3] The text of the regulation continues to give an example that “if a business collects the IP addresses of visitors to its website but does not link the IP address to any particular consumer or household, and could not reasonably link the IP address with a particular consumer or household, then the IP address would not be ‘personal information.’”[4] This is a helpful reminder to many who were worried about the broad applicability of the CCPA after seeing IP addresses listed as one example of “personal information” under the statute. Other helpful clarifications include additional examples of discriminatory practices under the CCPA.[5] These examples should help businesses adjust their loyalty programs to comply with the CCPA’s prohibition against discrimination. In addition to editing grammatical errors, other changes in the Revised Proposed Regulations impact privacy policies, mobile apps, notices to applicants and employees, loyalty programs, service providers, and handling and responding to consumer requests. The International Association of Privacy Professionals (IAPP) recently published this article summarizing some of these changes.[6]

The CCPA requires businesses to update their privacy disclosures; respond to consumer requests for data access, deletion, or to opt-out of data sales; ensure their loyalty programs do not discriminate against consumers; update their vendor agreements; train their staff; and implement reasonable security practices.[7] Feel free to contact the KMK Law Cybersecurity & Privacy Team for more information on how the CCPA and other various data privacy laws may be affecting your business.

[1] The text of the Revised Proposed Regulations, as well as other CCPA rulemaking documents, can be found here.

[2] The redline document, comparing the Revised Proposed Regulations against the Initial Proposed Regulations, can be found here.

[3] California Consumer Privacy Act Revised Proposed Regulations § 999.302(a),

[4] Id.

[5] California Consumer Privacy Act Revised Proposed Regulations § 999.336(d)(2),(3),(4).

[6] Elaine Critides, Jim Halpert, Lael Bellamy, CIPP/US, & Tracy Shapiro, CCPA proposed modified regs 2.0 issued in Calif., Privacy Tracker: IAPP (Feb. 11, 2020), https://iapp.org/news/a/ccpa-proposed-modified-regs-2-0-issued-in-california/.

[7] Cal Civ Code Div. 3, Pt. 4, Tit. 1.81.5.