The California Privacy Protection Agency ('CPPA') released, on 3 November 2022, a revised version of the proposed regulations under the California Consumer Privacy Act of 2018 ('CCPA'), following its board meeting, and is requesting public comments on the same. In particular, the CPPA made the following revisions to the proposed regulations, among others:

• clarification that where a business only uses or discloses sensitive personal information for specified purposes, provided that the use or disclosure is reasonably necessary and proportionate for those purposes, it will not be required to provide a 'Notice of Right to Limit' or provide a method for submitting a request to limit;
• expansion of an opt-out preference signal as a valid request to opt-out of the sale/sharing of personal information to include 'any consumer profile associated with that browser or device, including pseudonymous profiles', highlighting that the businesses must also treat opt-out preference signals as a valid request to opt-out of the sale/sharing;
• establishing that any information provided by the consumer must not be used, disclosed, or retained for any purpose other than processing the request to opt-out of the sale/sharing;
• clarification that a business' collection, use, retention, and/or sharing of a consumer's personal information must also be reasonably necessary and proportionate to achieve any purpose for which the business obtains the consumer's consent in compliance with §7002(e) of the revised proposed regulations;
• clarification that the opt-out of the sale/sharing through the business' privacy policy can be used by a business where it processes an opt-out preference signal in a frictionless manner;
• removal of the inclusion of a business' privacy policy as a required method to allow consumers to submit requests to limit the collection of sensitive personal information; and
• clarification that compliance with a consumer's CCPA request by an entity that provides services to a non-business will depend upon whether the entity is a 'business', as defined by §§1798.140 of the California Civil Code.

Public comments can be submitted via email to [email protected] with the subject line 'CPPA Public Comment' and the comments as an attachment until 21 November 2022.

You can read the notice here and the revised proposed regulations here.