Senior Content Marketing Manager II
April 6, 2023âą9 min read
The CPRA modified regulations state:Â
âa businessâs collection, use, retention, and/or sharing of a consumerâs personal information shall be reasonably necessary and proportionate to achieve [...] [t]he purpose(s) for which the personal information was collected or processedâ
This language shares the same reference point as the original CPRA text, but goes on to include:Â
Weâll cover the five considerations for evaluating consistency with consumer expectations below. That said, we highly recommend reviewing section § 7002 of the modified regulations to brush up on the other components.
Under the CPRA modified regulations, a consumerâs expectations around data processing are influenced by:Â
It will be interesting to see how this particular section of the modified regulations play out. Though the CPPA did clarify certain portions of the text, the terms 'reasonable' and 'proportionate' are inherently subjective. And, this was one instance where the modified regulations didnât provide examples.Â
In terms of implementation, this means many companies may end up looking to the CPPA for further guidance and/or peering over their neighbor's shoulder i.e. seeing how other companies approach this requirement. Itâs also likely that long-term enforcement will rely on early precedents.Â
CPRA was the first of Californiaâs privacy laws to specifically mention dark patterns, defining them as:Â
âa user interface designed or manipulated with the substantial effect of subverting or impairing user autonomy, decision making, or choice, as further defined by regulation.â
And going on to say that a consumerâs:
 â...agreement obtained through use of dark patterns does not constitute consent.âÂ
This expansion on valid consent is unique to the modified regulations, in that the concept of dark patterns didnât explicitly appear in the California Consumer Privacy Act (CCPA).Â
Broadening the scope of the CCPA, this new language reflects a commitment to regulating actions that are difficult to define yet have a clear impact on customers' decisions. It also allows California regulators to investigate dark patterns backed by a clear legal framework, increasing the likelihood of enforcement.Â
The CPRA modified regulations offer five guidelines for how a business can evaluate whether an interface or workflow is collecting valid consent. Read our full guide on dark patterns for CPRA compliance to learn more.
This one is pretty clear, but remember that âeasy to understandâ applies to both the language and design of your consent interface.Â
The modified regulations emphasize that consent interfaces should use straightforward language to explain a consumerâs choices and how to implement them. In other words, avoid legal mumbo jumbo, double negatives, or any misleading terms.Â
The same goes for designâthe interface should be designed so that the options and outcomes are clear.
Symmetry in choice means that choosing the âmore privacyâ option should not take more effort than the âless privacyâ option.
For example, cookie banners that give consumers the choice of "Accept all" and "More information" are not compliant. This is because consumers only need to click once to accept cookies, but must click multiple times to reject them.
Similarly, offering "Yes" and "Ask me later" as the only two options is also prohibited, because thereâs no way to reject the opt-in.
Double negatives are a prime example of confusing language. For example, having "Yes" or "No" next to the statement "Do Not Sell or Share My Personal Information." In this context, itâs not immediately clear that choosing "No" means agreeing to have your personal information shared or sold.
Coercive interactive elements are varied, but often appear as buttons that change depending on the user's options. For example, a "Confirm my choices" button might appear when all tracking cookies have been enabled, but if some cookies are deselected, the button changes to say "Allow all."Â
The CPRA modified regulations prohibit the use of language that could be perceived as guilt-inducing or shaming. For example, itâs considered manipulative and shaming to offer two options for accepting a discount, such as "Yes" and "No, I like paying full price."
Bundling reasonable anticipated uses with additional unexpected ones is also not allowed. In a location-based app, for example, consent to the sale of geolocation data cannot be paired with consent to access the core service.
Making your consent experience as frictionless as possible is also important, so donât add unnecessary manual steps. For instance, if a consumer wants to opt-out of the sale of their personal data, they canât be forced to search or scroll through a privacy policy after clicking the "Do Not Sell or Share My Personal Information" link.Â
Additionally, circular links, inactive or unmonitored email addresses, and broken UI experiences (such as a button that doesnât work) are also not allowed. If youâve relied on manual and/or fragmented processes so far, now is a good time to implement a smoother solution.
The CPRA modified regulations made three key updates to the requirements around notices at collection. Weâll summarize those below, but check out our full guide to CPRA notice at collection for more details.
Under the modified regulations, businesses no longer need to disclose what third parties are collecting personal data. The original text of the CPRA stated that any parties collecting personal data must be listed by name in a notice at collection, however these were removed from the modified rules in order to simplify implementation.
The initial CCPA language referred to an "analytics business" as a third party, indicating it shouldn't be considered a service provider. This inferred the businesses needed to offer the right to opt-out, even if they were only using a platform like Google Analytics.
However, in one example the modified regulations state that:
âin some instances an analytics business can be a service provider and not a third party.â
Following Sephoraâs settlement with the California attorney general (AG), this topic has been the subject of focused debate. Sephora's enforcement action hinged on a few factors, one of which was the AGâs stance that using an analytics provider counted as a de-facto sale. But according to the case statements, the real issue seemed to be that Sephora was treating their analytics platform (assumed to be Google Analytics) as a service provider, but hadn't bound the relationship with an appropriate service provider contract.Â
The CPRA modified regulations removed several subsections regarding the collection of employment-related information. According to the CPPA, these sections were removed following the expiration of the employee data exemption.Â
Check out guide on employee DSAR under CPRA here.
Under CCPA, there was some debate as to whether businesses needed to honor browser-based opt-out signals like the Global Privacy Control (GPC). However, the CPRA modified regulations made it clear that consumer preferences transmitted through these signals must be honored as long as they meet certain technical thresholds, specifically:Â
The modified regulations require that businesses who receive a consumerâs opt-out preference signal:
One change that businesses may welcome is the modified regulationâs approach to opt-out implementation. Under the CPRA modified regulations, businesses no longer need to display whether they are honoring a consumerâs opt-out preference. It's also now optional to inform consumers that their opt-out preference conflicts with their inclusion in financial incentive program, if that is in fact the case.
Section 7301(b) of the modified regulations state that, when investigating possible violations, the CPPA will:Â
âconsider all facts it determines to be relevant, including the amount of time between the effective date of the statutory or regulatory requirement(s) and the possible or alleged violation(s) [...] and good faith efforts to comply with those requirements."
The âgood faith effortsâ bit may provide some cover for businesses who are working on compliance, but havenât fully achieved it. That said, we donât recommend hanging your hat on the CPPAâs leniency.Â
The agency still holds the right to audit a businessâs CPRA compliance with or without notice. They may do so on the grounds that:
These criteria give the agency broad leeway in the way they audit and investigate companies, so though there may be some wiggle roomâdonât rely on that when building out your privacy program.
Though the CPPA has presented one round of modified regulations, which were accepted by the OAL, there are still a few topics that will require further rounds of rulemaking.Â
Specifically, the CPPA will consider further updates to the CPRAâs rules on data protection assessments and cybersecurity audits, automated decision-making, and employee data rights.Â
So while weâll have to wait and see what happens there, businesses should have enough information to work towards effective compliance before the July enforcement date.Â
Transcend is the platform that helps companies put privacy on autopilot by making it easy to encode privacy across an entire tech stack.
Transcend Data Mapping is the only solution that goes beyond observability to power your privacy program with smart governance suggestions. Get unified data management through automated scanning, data silo discovery and advanced data classification, all in a collaborative platform.
Ensure nothing is tracked without user consent using Transcend Consent, automate data subject request workflows with Privacy Requests, and mitigate risk with smarter privacy Assessments.
Senior Content Marketing Manager II