California AG proposes regulations to help businesses comply with new privacy law

With less than three months before California’s landmark internet privacy law takes effect, state Attorney General Xavier Becerra held a press conference Thursday to propose a set of regulations designed to give businesses more flexibility in complying with the law.

The regulations are the first draft of the state’s efforts to provide a framework for consumers and businesses to comply with the California Consumer Protection Act. The law is the first of its kind in the United States, and, as currently written, grants people the ability to determine whether they want companies to collect or sell their data. While it will set new rules for how companies doing business in California can legally collect, store and sell consumer data, it doesn’t actually instruct businesses on how to follow those rules, which is why Becerra was tasked with surveying public opinion from January to March this year to develop regulations that will guide the law’s implementation. 

Becerra said the proposed regulations will help businesses navigate five components of the CCPA: notifying consumers of their rights either at or before the point of data collection; handling consumer requests about their data; verifying consumers’ identities as they receive information-related requests; processing requests concerning information on behalf of children under the age of 16; and avoiding discrimination against customers who choose not to allow their data to be stored or sold. 

The idea is to help businesses follow the new law without stifling their ability to improve their products using consumer data, Becerra said. He said the state isn’t interested in “gotcha” tactics, or willfully misleading any business, but that consumers should understand what information is being collected on them and why. 

“Innovation shouldn’t come at the expense of privacy, and California can walk and chew gum at the same time,” Becerra said at the press conference. 

The proposed regulations will now enter a period of public comment until Dec. 6, during which people can offer feedback via mail, email or three in-person hearings held in early December throughout the state. Becerra will then determine whether any major changes are needed to the regulations, and either publish them or kick off another public comment period following a change.

Independent estimates have asserted that compliance with the law will cost the private sector $55 billion, raising anticipation for Becerra’s regulations. Though the CCPA will require companies to be compliant on Jan. 1, with enforcement beginning July 1, there could still be more tweaks to the law before it takes full effect. Along with Becerra’s proposed regulations, the California State Legislature recently passed a handful of bills intended to water down some of the CCPA’s more sweeping protections; Gov. Gavin Newsom has not signed any of them yet.

The impending law is popular among Californians, though. A poll published earlier this month found that 87 percent of consumers would opt out of letting companies collect and resell their personal information if given the option.

“CCPA would allow you to pull the curtains back to see what information companies have collected about you so that if you want, you could have that information deleted,” Becerra said during the press conference. “It would also allow the company to say that ‘you can use this data on me for your own purposes, but aren’t allowed to sell it to other companies or data brokers.”