Law / United States / 
California
CCPA Regulations: purpose limitation and the design of disclosures, request methods and consent (article 1)
Also known as CCPA Regulations.
Cal. Code Regs. tit. 11, sections 7002 to 7004
In force since .
A comprehensive regime rule binding private bodies.
- Obligation class
- Consent, Disclosure, Prohibition
As of .
What it requires
- Keep your collection, use, retention and sharing of a consumer's personal information reasonably necessary and proportionate to the purpose for which you collected or processed it, which must be consistent with the consumer's reasonable expectations, or to another disclosed purpose compatible with the context of collection (section 7002).
- Write disclosures and communications to consumers in language that is easy to read and understand, and make the disclosures Article 2 requires readable on smaller screens, available in the languages in which you ordinarily deal with California consumers, and reasonably accessible to consumers with disabilities (section 7003).
- Design the methods for submitting CCPA requests and obtaining consumer consent to be easy to understand, symmetrical in choice (the privacy-protective path is no longer or harder than the less protective one) and easy to execute, without unnecessary burden or friction (section 7004(a)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
California Privacy Protection Agency, which may open an investigation on a sworn complaint or on its own initiative (section 7301(a) of the Regulations).
What this law does
Section 7002(a) of the CCPA Regulations requires a business's collection, use, retention and sharing of a consumer's personal information to be reasonably necessary and proportionate to achieve the purpose for which it was collected or processed, or another disclosed purpose compatible with the context in which it was collected.
Under section 7002(b), the purpose for which personal information was collected or processed must be consistent with the reasonable expectations of the consumers whose personal information is collected or processed. Section 7003(a) requires disclosures and communications to consumers to be easy to read and understandable to consumers.
Section 7004(a) requires a business to design and implement methods for submitting CCPA requests and obtaining consumer consent that incorporate the principles it lists. Under section 7004(a)(2), the path for a consumer to exercise a more privacy-protective option may not be longer or more difficult or time-consuming than the path to exercise a less privacy-protective option.
Under section 7004(a)(5), a business may not add unnecessary burden or friction to the process by which the consumer submits a CCPA request or provides or withdraws consent. The Agency's regulations became effective on .
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, processes voice recordings or processes biometric data.