The California Attorney General (AG) has approved additional regulations to implement the California Consumer Privacy Act (CCPA), the landmark privacy law that gives Californians the right to access, delete, and stop the sale of their information. The new rules became effective on March 15, 2021.
In an important step forward for consumers, the AG took action on Monday to finalize draft rules that prohibit companies from using “dark patterns”—methods that impair a consumer’s choice to opt out and intentionally make it overly complex to navigate. The new regulations relied in part on a Consumer Reports study, released late last year, that found that too often, burdensome or broken opt-out processes prevented consumers from exercising their rights under the CCPA.
The AG also finalized the design of an opt-out icon that businesses can use to help make consumers more aware of their right to opt out, as CR recommended, but declined to clearly require companies to use the icon.
“We applaud the California Attorney General for prohibiting some of the worst opt-out processes,” said Maureen Mahoney, Senior Policy Analyst at Consumer Reports. “We urge the AG to closely monitor companies’ compliance with the law, and continue to use their regulatory and enforcement authority to make it easier for consumers to stop the sale of their information.”
CR also calls on the AG to address ambiguities in the definition of a sale and the service provider provisions that companies have used to continue delivering targeted advertising in spite of the opt-out provision in the CCPA. While these loopholes will be addressed by Proposition 24 when it becomes fully operative in 2023, CR is asking the AG to act as soon as possible to prevent companies from circumventing the law.
Contact: Cyrus Rassool, cyrus.rassool@consumer.org