Final Rules for CCPA

Per Protocol:

Technically, the California Consumer Privacy Act (CCPA) has been law since January. Companies were given six months to figure out how to comply, while the state figured out the final rules and how to enforce them.

Enforcement never stops being tricky, as we’ve seen with GDPR. But at least now we have the rules: California AG Xavier Becerra submitted final regulations to the state’s Office of Administrative Law yesterday.

• Most of the changes aren’t substantive so much as clarifying. Who counts as a “third party?” What’s “employment-related information?” Do you have to respond to requests in 10 days, or 10 business days? Who counts as an “average consumer?” Also, a lot of reordering and renumbering.
• The new rules also offer businesses a lot of specific guidance — on where to put links and notices on their websites, how to reach people offline, when they do and don’t need to respond to requests, and more.

The law has been through the ringer recently, subject to open forums and public comments from a huge number of people.

• The list includes plenty of tech bigwigs: Roger McNamee, Brave’s Johnny Ryan, Apple’s Katie Kennedy, Okta’s Fatime Khan, Google’s Cynthia Pantazis, Mapbox’s Thomas Lee and Kathleen Lu, and many others. Even Alistair McTaggart, who’s already trying to write new privacy legislation, weighed in.
• Few commenters were more prolific than Kevin McKinley, the Internet Association’s director of government affairs.
• All of which is to say, the tech industry has made very certain that its voice was heard.

There’s a final review step for the rules, before they’re signed into law. CCPA enforcement is scheduled to begin July 1, which means businesses have a month to get caught up on the rules and get on board.

 

To view the final regulation, click here.