California AG Submits Final Privacy Rules at Deadline
Businesses will soon have to comply with the California Consumer Privacy Act despite calls for delay and speculation the state DOJ would miss an important procedural deadline. California Attorney General Xavier Becerra (D) submitted final rules for implementing CCPA just before Monday night’s Office of Administrative Law deadline (see 2006020039). Final text included no substantial changes to regulations from a March revised draft submitted for OAL review.
Sign up for a free preview to unlock the rest of this article
Export Compliance Daily combines U.S. export control news, foreign border import regulation and policy developments into a single daily information service that reliably informs its trade professional readers about important current issues affecting their operations.
The AG had to submit rules Monday to get laws into effect by July 1 when enforcement starts, or they could have been delayed until October (see report, June 2). It’s up to OAL what date they are released. The AG office asked the administrative office for an expedited review of 30 business days. The office normally has 30 working days but due to COVID-19 may take an additional 60 calendar days to approve state regulations. After OAL approves, the final regulation text would be filed with the secretary of state and become enforceable.
CCPA took effect Jan. 1 but gave the AG extra time to write rules. The law allows enforcement before the AG's final regulations are in force. “We are committed to enforcing it starting July 1,” Becerra said Tuesday. About 60 business groups sought delay due to COVID-19 (see 2004020043). A November ballot vote could again change California privacy laws (see 2005080037).
Submitting the rules less than a month before they can be enforced is “troubling” to the Association of National Advertisers, one of the groups that sought a six-month delay, said Group Executive Vice President-Government Relations Dan Jaffe in an interview. Uncertainty remains because they aren't approved and it’s unclear when they will be, he added. The situation puts companies that want to comply in a “difficult position” he said. ANA is reviewing the final text and had concerns about legal problems with the previous version, said Jaffe. CCPA will have “enormous impacts” statewide and beyond, he said.
No changes from the last draft is good and bad, emailed Media Alliance Executive Director Tracy Rosenberg. Privacy advocates are glad the AG rejected many business requests that would have weakened CCPA but “disappointed that a few changes we recommended were not incorporated,” including to accept browser do-not-track requests as opt outs.
The AG rejected that and every other suggestion from comments on the March draft, showed a new appendix. “The regulations do not prohibit a business from responding and respecting a user’s ‘do not track’ signal,” the AG office said. “The business has discretion to treat a ‘do not track’ signal as a useful proxy for communicating a consumer’s privacy choices.”