The California Attorney General (“AG”) has submitted his proposed final CCPA regulations to the California Office of Administrative Law (“OAL”).
The proposed final rules substantively are the same as the draft rules released for public notice on March 11, which we summarized previously here. However, the AG’s responses to comments and Final Statements of Reasons accompanying the final rulemaking package provide guidance on the AG’s position on key ambiguities under the CCPA. For example, in declining to clarify whether the use of website cookies shared with third parties is a “sale,” the AG emphasized that, “[w]hether the particular situations raised in the comments constitutes a “sale” raises specific legal questions that would require a fact-specific determination, including whether or not there was monetary or other valuable consideration involved, the consumer directed the business to intentionally disclose the personal information, and whether the parties involved were service providers.” The response thus is consistent with a determination that there is no “sale” of personal information based on specific facts and circumstances. Other commentary provides guidance on such topics as the AG’s understanding of financial incentive provisions, obligations to respond to access and deletion requests, and when the law is applicable.
In terms of process and timing, the OAL has a period of time to review the draft rules for compliance with the California Administrative Procedure Act. Typically, this period is 30 business days, but this has been extended for an additional 60 calendar days as part of one of the California Governor’s COVID-related executive orders. Upon approval, the OAL will file the rules with the Secretary of State.
Under California law, rules typically go into effect on a quarterly schedule, and proposed rules filed with the Secretary of State between June 1 and August 1 would typically go into effect October 1. However, the AG has submitted a request to OAL for the rules to go into effect immediately at the time the rules are filed with the Secretary of State rather than on the quarterly schedule. His request for expedited timing does not does not include a clear statement of necessity, public interest, or other rationale for the earlier effective date. The closest he appears to comes is the statement that, “Once final regulations are adopted, the Attorney General will enforce the regulations that establish procedures to facilitate new consumer rights under the CCPA and provide guidance to businesses for how to comply.”