On May 27, 20222, the California Privacy Protection Agency issued its first draft of Proposed Regulations under the California Privacy Rights Act. The rulemaking timeline is unclear but we expect additional information at the upcoming June 8, 2022 board meeting (agenda: https://cppa.ca.gov/meetings/agendas/20220608.pdf). The Proposed Regulations can be found here https://cppa.ca.gov/meetings/materials/20220608_item3.pdf
High-level topics in the Proposed Regulations include:
- Restrictions on the Collection and Use of PI
- Requirements for Disclosures and Communications to Consumers
- Requirements for Methods for Submitting CCPA Requests and Obtaining Consumer Consent (including Dark Patterns)
- Privacy Policy Requirements
- Pre-Collection Notice Requirements
- Requirements for Opt-Outs
- Requirements for Limiting the Use of Sensitive PI
- Requirements for Notice of Financial Incentive
- Handling of Consumer Requests
- Opt-Out Signals Preferences
- Contract Requirements for Service Providers, Contractors, and Third Parties