The CCPA regulations govern compliance with the California Consumer Privacy Act. They provide guidance to businesses on how to inform consumers of their rights under the CCPA, how to handle consumer requests, how to verify the identity of consumers making requests, and how to apply the law as it relates to minors. In doing so, the regulations make it easier for consumers to exercise their CCPA rights.
The regulations went into effect on August 14, 2020. Additional amendments to the regulations went into effect on March 15, 2021. Below are the documents that were submitted to the Office of Administrative Law (OAL). Anyone who submitted a comment regarding the regulations has the right to request a copy of the final statement of reasons.
In November 2020, voters approved Proposition 24, the California Privacy Rights Act of 2020, establishing the California Privacy Protection Agency (CPPA) to implement and enforce the California Consumer Privacy Act. On October 21, 2021, the CPPA provided notice to the Attorney General that it was prepared to assume rulemaking responsibilities. Rulemaking authority transfers from the Attorney General to the CPPA six months after this notice.
Rulemaking documents for Amendments to CCPA Regulations - The pdf of documents is bookmarked for ease of reference. It contains the following documents:
- Notice of Third Set of Proposed Modifications
- Third Set of Proposed Modifications
- Statement of Mailing for Third Set of Modifications
- Notice of Fourth Set of Proposed Modifications
- Fourth Set of Proposed Modifications
- Statement of Mailing for Fourth Set of Modifications
- Public Comments regarding Third and Fourth Set of Modifications
- Additional Documents Relied On
- Cranor, et al., CCPA Opt-Out Icon Testing – Phase 2 (May 28, 2020). Habib, et al., An Empirical Analysis of Data Deletion and Opt-Out Choices on 150 Websites, USENIX Symposium on Usable Privacy and Security (SOUPS) 2019, August 11-13, 2019, Santa Clara, CA, USA.
- Habib, et al., “It’s a scavenger hunt”: Usability of Websites’ Opt-Out and Data Deletion Choices, CHI ’20: Proceedings of the 2020 CHI Conference on Human Factors in Computing Systems, April 2020, Honolulu, HI, USA. (Article begins on page 21).
- Luguri, Jamie and Strahilevitz, Lior, Shining a Light on Dark Patterns (August 1, 2019), University of Chicago, Public Law Working Paper No. 719, University of Chicago Coase-Sandor Institute for Law & Economics Research Paper No. 879.
- Mahoney, et al., California Consumer Privacy Act: Are Consumers’ Digital Rights Protected? (October 1, 2020), Consumer Reports.
- Addendum to Updated Informative Digest
- Second Addendum to Final Statement of Reasons
- Appendix G – Summary and Response to Comments Submitted during Third 15-Day Comment Period
- Appendix H – List of Commenters from Third 15 Day Period
- Appendix I – Summary and Response to Comments Submitted during Fourth 15-Day Comment Period
- Appendix J – List of Commenters from Fourth 15 Day Period