(AP Photo/Jenny Kane, File)
Last week California passed significant legislation to further empower the California Consumer Privacy Act (CCPA). The newly passed rules give more substantial teeth to protect the rights of consumers by forcing confusing and dubious language out of circulation.
California Attorney General Xavier Becerra made the announcement last Tuesday and said the change was a significant step in giving consumers control of their own data.
“California is at the cutting edge of online privacy protection, and this newest approval by the [Office of Administrative Law] OAL clears even more hurdles in empowering consumers to exercise their rights under the California Consumer Privacy Act,” Attorney General Becerra said in a press release.
Currently, the CCPA grants California consumers the right to know, the right to delete, and the right to opt-out of the sale of the personal information collected by businesses and also affords additional protections for minors.
Previously the language offered by the CCPA was ambiguous and offered some loopholes, loopholes which the new rules seek to close by making use of “dark patterns” illegal.
It’s now illegal to:
- Require more steps than that business’s process for a consumer to opt-in to the sale of personal information after having previously opted out
- Use confusing language, such as double-negatives (e.g., “Don’t Not Sell My Personal Information”), when providing consumers the choice to opt-out.
- Require consumers to click through or listen to reasons why they should not submit a request to opt-out before confirming their request.
- Require the consumer to provide personal information that is not necessary to opt-out.
The announcement also revealed an official opt-out icon to be used in such instances and mechanisms.
“These protections ensure that consumers will not be confused or misled when seeking to exercise their data privacy rights, ” said Becerra. “The regulations include an eye-catching Privacy Options icon that guides consumers to where they can opt-out of the sale of their personal information.”
The “Privacy Options Opt-Out Icon.” Image: California Office of Administrative Law
The Attorney General’s office says that businesses have been largely compliant since the consumer protection measures went into effect last summer. However, those in breach of the laws receive ‘notice to cure’ that provides a 30-day window to remedy their non-compliance. Businesses so far to receive these notices have also been reportedly largely compliant.
The California Consumer Privacy Act will further be expanded in 2023 after California voters (56% Yes) passed Proposition 24, the California Privacy Rights Act (CPRA) which targets, among other things, protecting minors data rights. The new rules will include measures that require user permission before collecting data from consumers younger than 16 or from a parent or guardian for those younger than 13.