California Officials Adopt CCPA Regulation Amendments and Appoint Inaugural Members of Privacy Agency

On March 15, 2021, the California Office of Administrative Law adopted amendments to the regulations implementing the California Consumer Privacy Act (CCPA), including several changes to make it easier for consumers to opt out of a business' sale of personal information. The amendments took effect immediately upon adoption. Two days later, the California Governor, Attorney General, and legislative leaders announced the appointments of the five inaugural members of the board for the California Privacy Protection Agency (the Agency), as required by the California Privacy Rights Act of 2020 (CPRA), which significantly amended the California Consumer Privacy Act (CCPA). The Agency will have full administrative powers to implement and enforce the CCPA/CPRA.

What Are the Opt-Out-Related Changes?

• Privacy Options Icon. The amendments prescribe a new, very simple opt-out mechanism: clicking on the check or the X in the icon below.



• Businesses are not required to provide this icon, but if they do, the icon must be approximately the same size as any others that the business uses on its webpage. And even with the new icon, businesses that sell personal information are still required to post a "Do Not Sell My Personal Information" link on their websites.
• Dark Patterns. The amendments prohibit businesses from using so-called "dark patterns" that substantially complicate consumers' attempts to opt out of the sale of their personal information. The amendments provide several examples of such "patterns," such as requiring consumers who may want to opt out to first click through a list of reasons for why they should not opt out, using confusing language regarding the right to opt out, and requiring consumers to provide personal information that is not necessary to honor their opt-out requests.
• Offline Opt-Out Notices. Businesses that sell the personal information of consumers obtained in the offline context (e.g., brick-and-mortar stores that collect personal information at customer service desks and sell that information to third parties for marketing purposes) must now provide consumers with a notice of their right to opt out of such sales. This can be done by posting a notice indicating where opt-out information can be found online, or by providing notice on paper forms that collect consumers' personal information. For businesses that collect personal information over the phone, it is permissible to inform consumers of their opt-out right orally during the course of a call.

Inaugural Agency Board Members

The Agency is tasked with adopting final regulations implementing the CPRA by July 1, 2022 (one year before the law becomes enforceable on July 1, 2023). On March 17, 2021, Governor Gavin Newsom, Attorney General Xavier Becerra, Senate President pro Tempore Toni G. Atkins, and Assembly Speaker Anthony Rendon announced that the Agency board will be comprised of the following members:

• Jennifer M. Urban, who will serve as chair of the board. She is currently the Clinical Professor of Law and Director of Policy Initiatives for the Samuelson Law, Technology, and Public Policy Clinic at the University of California, Berkeley School of Law.
• Christopher Thompson, who is the Vice President of Government Relations at LA28, where he works with lawmakers to develop and advance policies for the 2028 Summer Olympic Games to be held in Los Angeles.
• Angela Sierra, who recently served as chief assistant attorney general of the Public Rights Division in the California Attorney General's office.
• Lydia de la Torre, who is a privacy law professor at Santa Clara University Law School and attorney at Squire Patton Boggs.
• Vinhcent Le, who currently serves as a Technology Equity attorney at the Greenlining Institute, where he focuses on consumer privacy among other areas.

The Agency may pursue administrative enforcement actions under the CCPA/ CPRA, and impose penalties of up to $2,500 for each violation—and $7,500 for each intentional violation involving the personal information of consumers who are known to be under 16 years old. The Agency board will be tasked with appointing the Agency's executive director, officers, counsel, and employees.

If you have any questions about these developments or any aspects of the CCPA/CPRA, we would be happy to help advise you.

© Arnold & Porter Kaye Scholer LLP 2021 All Rights Reserved. This blog post is intended to be a general summary of the law and does not constitute legal advice. You should consult with counsel to determine applicable legal requirements in a specific fact situation.