In our recent legal update (click here) we discussed the types of businesses the California Consumer Privacy Act of 2018 (CCPA) would impact. On October 10, 2019 the California Attorney General released a first draft of CCPA compliance guidance regulations. These are proposed regulations, and are subject to change.

The proposed regulations address several key points, including:

• Notices to consumers of information collection must be stated in layman’s terms, yet detailed enough to cover all required disclosures and in a format which draws attention to the Notice;
• Consumer Requests must be handled promptly, and verification procedures must be implemented to minimize the risk that personal information will be disclosed to the wrong party;
• Privacy policies must conform with the proposed regulations’ requirements, including specifying who collects personal information, how long the information may be kept, and to whom the information may be transferred or sold, among other requirements;
• Discrimination against users who “opt-out” of data collection and sale is prohibited; however, the regulations do contemplate situations in which preferential pricing may be non-discriminatory.

The CCPA takes effect January 1, 2020. A public comment period will remain open on the proposed regulations through December 6, 2019, and the Attorney General’s Office will continue to release updated regulations.