What happened?

According to the July 16, 2024, Board Meeting of the California Privacy Protection Agency (CPPA) has updated its enforcement priorities.

What are the details?

The CPPA on July 16, 2024, left the agency with updated priorities on 3 topics, according to the agenda provided:

• Privacy Notices and Policies
• Dark Patterns
• Consumer requests to opt-out or identity verification

Regulators also clarified their focus on compliance with CPRA amendments and ad tracking. They plan to utilize in-house technicians, experts, and various technologies, including commercial tools, for ad tracking assessment.

While these areas are prioritized, the scope of investigations will not be confined to them.

Business Considerations

• Employers should review their consumer response practices, understanding the specific requirements and deadlines that govern the consumer response process under the CCPA. A detailed manual outlining this process is highly recommended.
• Employers should ensure their notices and privacy policies are complete and accurate. These documents should accurately describe business practices, including the categories of personal information collected, who it is disclosed to, and how it is used. The CCPA requires privacy policies to be updated at least once annually.
• Employers should review their websites for dark patterns. This involves checking all the links and contact points in the privacy policy and related to consumer rights work. It could be beneficial to have someone unfamiliar with the website try to exercise consumer rights to ensure they can do so in an unbiased assessment.
• Employers should be aware that the California Attorney General and the CPPA will consider several factors in their investigations, including whether there was a violation, if the target can demonstrate good faith efforts to comply with CCPA requirements, the stance throughout the investigation, and whether there are appropriate equitable remedies available.
• Employers should consider ensuring that they are looking beyond public-facing compliance efforts, such as posted privacy notices, and into how businesses are implementing their CCPA compliance program requirements internally.
• Employers should be prepared for compliance checks with the CPRA amendments as well as ad tracking. Regulators will rely on their in-house technicians and experts, as well as technologies, including commercially available tools, to assess ad tracking.

Source References

• CPPA July 16, 2024 Board Meeting Resources
• Potential CCPA Fines “Significant”, California AG’s Office “Plotting” and Other Takeaways From Privacy Regulators during Privacy Summit in Los Angeles (Squire Patton Boggs)
• California Agency Provides Insights into CCPA Enforcement Priorities: 3 Tips for Staying Off the Enforcement Radar (Fisher & Phillips LLP.)

Resources

• CPPA Resources for Businesses
• CPPA Enforcement Division Issues First Advisory

This communication is intended solely for the purpose of conveying information. The present post might incorporate hyperlinks directing readers to websites managed by third-party entities. The inclusion of any links within this communication is meant to serve as points of reference and could encompass opinion articles from various law firms, articles from HR associations, official websites, news releases, and documents of government agencies, and other relevant third-party sources. Vensure has no authority over these external websites and bears no responsibility for their content. Furthermore, Vensure does not endorse the materials present on these websites. The contents of this communication should not be interpreted as legal advice or as a legal standpoint concerning specific facts or scenarios. Nor should it be deemed an exhaustive compilation of facts potentially pertinent to federal, state, or local laws. It is strongly advised that employers solicit legal guidance from an employment attorney when undertaking actions in response to any legal updates provided. This is due to the possibility of future alterations occurring in federal, state, and local laws, regulations, as well as the directives and guidelines issued by governing agencies. These changes may transpire at any given time, potentially rendering certain portions of the content within this update void or inaccurate.