As you know by now, the California Consumer Privacy Act of 2018 (“CCPA”) is California’s groundbreaking legislation that grants California residents unprecedented rights and protections regarding the collection and use of their personal information. While the breadth and scope of the CCPA is readily transparent, California’s Attorney General (“AG”) is still in the process of adopting regulations to help implement the act. The AG is currently accepting comments in a series of public forums that began in January, and the California Department of Justice recently announced a March 8 deadline for submitting written pre-rulemaking comments. The AG will consider these pre-rulemaking comments when drafting CCPA rules and regulations. In the meantime, the CCPA sets out seven specific areas for AG rulemaking:

(1) Identifying the categories of personal information subject to the CCPA in order to address changes in technology, data collection practices, obstacles to implementation, and privacy concerns;

(2) Defining ‘unique identifiers’ under the CCPA to address changes in technology, data collection, obstacles to implementation, and privacy concerns, and additional categories to the definition of designated methods for submitting requests to facilitate a consumer’s ability to obtain information from a business upon request;

(3) Establishing exceptions to the CCPA where necessary to comply with federal or state law, including but not limited to those relating to trade secrets and intellectual property rights;

(4) Establishing rules and procedures: (a) To facilitate and govern the submission of a request by a consumer to opt-out of the sale of personal information; (b) To govern business compliance with a consumer’s opt-out request; (c) For the development and use of “a recognizable and uniform opt-out logo or button by all businesses to promote consumer awareness of the opportunity to opt-out of the sale of personal information;”

(5) Adjusting the monetary thresholds for businesses to be covered by the CCPA;

(6) Establishing rules, procedures, and any exceptions necessary to ensure that notices and information that businesses are required to provide under CCPA are provided “in a manner that may be easily understood by the average consumer, are accessible to consumers with disabilities, and are available in the language primarily used to interact with the consumer,” including establishing rules and guidelines regarding financial incentive offerings; and

(7) Establishing rules and procedures to facilitate a consumer’s or the consumer’s authorized agent’s ability to obtain information upon request, “with the goal of minimizing the administrative burden on consumers, taking into account available technology, security concerns, and the burden on the business” and to govern a business’ determination that a request for information received by a consumer is a verifiable consumer request.

The first draft of regulations will be published via a Notice of Proposed Regulatory Action in the Fall of 2019. After the notice is published, the AG will hold public hearings during a formal comment period. Unless significant changes are made to the regulations in response to public comments, the regulations will be finalized and implemented. The CCPA requires the AG to adopt formal CCPA regulations on or before July 1, 2020. Thereafter, enforcement actions by the AG will commence.