Pursuant to section 1798.185(a) of the CCPA, the California Attorney General (AG) is obligated to solicit broad public participation and adopt regulations to further the purposes of the CCPA. The CCPA sets out seven specific areas for AG rulemaking:

1.  Updating as needed the categories of personal information expressly enumerated in the definition of personal information in order address changes in technology, data collection practices, obstacles to implementation, and privacy concerns.

2.  Updating as needed the definition of unique identifiers to address changes in technology, data collection, obstacles to implementation, and privacy concerns, and additional categories to the definition of designated methods for submitting requests to facilitate a consumer’s ability to obtain information from a business upon request.

3.  Establishing any exceptions to the CCPA necessary for businesses to comply with state or federal law, including but not limited to those relating to trade secrets and intellectual property rights.

4.  Establishing rules and procedures:

a.  To facilitate and govern the submission of a request by a consumer to opt-out of the sale of personal information.

b.  To govern business compliance with a consumer’s opt-out request.

c.  For the development and use of “a recognizable and uniform opt-out logo or button by all businesses to promote consumer awareness of the opportunity to opt-out of the sale of personal information.”

5.  Adjusting the monetary thresholds for businesses to be covered by the CCPA.

6.  Establishing rules, procedures, and any exceptions necessary to ensure that notices and information that businesses are required to provide under CCPA are provided “in a manner that may be easily understood by the average consumer, are accessible to consumers with disabilities, and are available in the language primarily used to interact with the consumer,” including establishing rules and guidelines regarding financial incentive offerings.

7.  Establishing rules and procedures to facilitate a consumer’s or the consumer’s authorized agent’s ability to obtain information upon request, “with the goal of minimizing the administrative burden on consumers, taking into account available technology, security concerns, and the burden on the business” and to govern a business’ determination that a request for information received by a consumer is a verifiable consumer request.

The CCPA also expressly states that the AG “may adopt additional regulations as necessary to further the purposes of [the CCPA].”

The AG will consider pre-rulemaking comments when drafting CCPA rules. The AG’s slide deck about its ongoing CCPA public forums indicates that the first draft of the regulations is expected to be published via a Notice of Proposed Regulatory Action in Fall 2019. After the notice is published, the AG will hold public hearings during the formal comment period. Significant changes made to the regulations in response to public comments may trigger an additional comment period. Otherwise, the regulations will proceed through the finalization process and eventually be adopted by the California Department of Justice. The CCPA requires that the AG adopt CCPA regulations on or before July 1, 2020.

Click here for the Attorney General’s CCPA rulemaking website, which includes instructions for submitting written comments and a list of the remaining CCPA public forum events.

Authored by Timothy Tobin, Harriet Pearson, Mark Brennan, Bret Cohen and Ryan Woo