California Consumer Privacy Act (CCPA)

Proposed Regulations Package Submitted to OAL

On June 1, 2020, the Office of the California Attorney General submitted the final proposed regulations package under the California Consumer Privacy Act (CCPA) to the California Office of Administrative Law (OAL). The complete package, including the Final Text of Proposed Regulations and the Final Statement of Reasons, is posted below. OAL has 30 working days, plus an additional 60 calendar days under Executive Order N-40-20 related to the COVID-19 pandemic, to review the package for procedural compliance with the Administrative Procedure Act. Once approved by the OAL, the final regulation text will be filed with the Secretary of State and become enforceable by law. For more information on the rulemaking process, please see the CCPA Rulemaking Fact Sheet.

CCPA was signed into law on June 28, 2018, and went into effect on January 1, 2020. CCPA grants California consumers robust data privacy rights and control over their personal information, including the right to know, the right to delete, and the right to opt-out of the sale of personal information that businesses collect, as well as additional protections for minors.

# Document Name Date of Event
1. Final Text of Proposed Regulations June 1, 2020
  WWW Consortium, Web Content Accessibility Guidelines, version 2.1 (June 5, 2018). [Incorporated by Reference]  
2. Final Statement of Reasons June 1, 2020
  Appendix A. Summary and Response to Comments Submitted during 45-Day Period  
  Appendix B. List of Commenters from 45-Day Period  
  Appendix C. Summary and Response to Comments Submitted during 1st 15-Day Period  
  Appendix D. List of Commenters from 1st 15-Day Period  
  Appendix E. Summary and Response to Comments Submitted during 2nd 15-Day Period  
  Appendix F. List of Commenters from 2nd 15-Day Period  
3. Updated Informative Digest June 1, 2020
4. Written Justification for Earlier Effective Date and Request for Expedited Review June 1, 2020
5. Notice of Proposed Rulemaking October 11, 2019
6. Original Proposed Regulations October 11, 2019
7. Initial Statement of Reasons (ISOR), includes Appendices A, B October 11, 2019
8. Statement of Mailing First 45-Day Notice May 27, 2020
9. First Notice of Modifications February 10, 2020
10. First Modified Regulations February 10, 2020
11. Statement of Mailing First 15-Day Notice May 27, 2020
12. Second Notice of Modifications March 27, 2020
13. Second Modified Regulations March 27, 2020
14. Statement of Mailing Second 15-Day Notice May 27, 2020
15. Public Comments

Note: The comments are marked up based on each commenter and their comments.
  45 Day Written Comments Comment Period Ended: December 6, 2019
  First Set 15 Day Written Comments Comment Period Ended: February 25, 2020
  Second Set 15 Day Written Comments Comment Period Ended: March 27, 2020
16. Public Hearing Transcripts

Note: The transcripts of the public hearings are marked up based on each commenter and their comments.
  Sacramento December 2, 2019
  Los Angeles December 3, 2019
  San Francisco December 4, 2019
  Fresno December 5, 2019
17. Form 399  
18. Form 400 June 1, 2020
19. Materials/Documents Relied Upon
Appendix A: Preliminary Activities
  California Department of Justice, Attorney General’s Office, California Data Breach Report (February 2016).  
 

California Department of Justice, Attorney General’s Office, Public Comments Received as Part of the Preliminary Rulemaking Process.

 
 

California Department of Justice, Attorney General’s Office, Supplemental Public Comments Received as Part of the Preliminary Rulemaking Process

 
 

California Department of Justice, Attorney General’s Office, Transcript of Fresno Public Forum.

February 13, 2019
 

California Department of Justice, Attorney General’s Office, Transcript of Inland Empire/Riverside Public Forum.

January 24, 2019
 

California Department of Justice, Attorney General’s Office, Transcript of Los Angeles Public Forum.

January 25, 2019
 

California Department of Justice, Attorney General’s Office, Transcript of Sacramento Public Forum.

February 5, 2019
 

California Department of Justice, Attorney General’s Office, Transcript of San Diego Public Forum.

January 14, 2019
 

California Department of Justice, Attorney General’s Office, Transcript of San Francisco Public Forum.

January 8, 2019
 

California Department of Justice, Attorney General’s Office, Transcript of Stanford Public Forum.

March 5, 2019
Appendix B: 45-Day Period
  Acquisti et al., What Is Privacy Worth? (2013) The Journal of Legal Studies, 42(2), pp. 249-274.  
 

Center for Plain Language, Privacy-policy analysis (2015).

 
 

Federal Trade Commission, Protecting Consumer Privacy in an Era of Rapid Change: Recommendations for Businesses and Policymakers, FTC Report (March 2012).

 
  Hahn et al., A data processing addendum for the CCPA? (Jun. 19, 2019) IAPP Privacy Perspectives.  
  Montes et al., The value of personal information in markets with endogenous privacy (Aug. 5, 2015) CEIS Working Paper No. 352.  
  National Telecommunications and Information Administration, U.S. Department of Commerce, Short Form Notice Code of Conduct to Promote Transparency in Mobile App Practices (July 25, 2013).  
  Norton, The Non-Contractual Nature of Privacy Policies and a New Critique of the Notice and Choice Privacy Protection Model (2016) 27 Fordham Intell. Prop. Media & Ent. L.J. 181.  
  Pew Research Center, Public Perceptions of Privacy and Security in the Post-Snowden Era (November 14, 2014).  
  Reidenberg et al., Ambiguity in Privacy Policies and the Impact of Regulation (March 22, 2016) Journal of Legal Studies, Forthcoming; Fordham Law Legal Studies Research Paper No. 2715164.  
  Schaub, et al., A Design Space for Effective Privacy Notices (July 22–24, 2015) Symposium on Usable Privacy and Security (SOUPS) 2015, Ottawa, Canada.  
  Short et al., What’s Your Data Worth? (Mar. 3, 2017) MIT Sloan Management Review, Spring 2017 Issue.  
  Spiekermann, et al., Towards a Value Theory for Personal Data (April 2017) Journal of Information Technology, Vol. 32, Issue 1, 2017.  
Appendix C: 15-Day Period
  Accenture Interactive, See people, not patterns. (2019).  
  Cranor, et al., Design and Evaluation of a Usable Icon and Tagline to Signal an Opt-Out of the Sale of Personal Information as Required by CCPA (February 4, 2020).  
  Douglis, et al., How the CCPA impacts civil litigation (January 28, 2020).  
  Duffy, et al., Retail Loyalty Programs Will Survive Calif. Privacy Law (September 26, 2019), Law360  
  Paternoster, Leon, Getting round GDPR with dark patters. A case study: Techradar (August 12, 2018).  
  Simon, et al., Summary of Key Findings from California Privacy Survey (October 16, 2019), Goodwin Simon Strategic Research.