California Privacy Regulations Come into Effect

A California court recently ruled that enforcement of the California Privacy Protection Act (CPPA/CPRA) regulations should begin immediately, following a stay of enforcement proceedings by the court.

The regulations manage many practical aspects of the provisions of the state’s privacy law. Among other things, the regulations address the following topics:

1. Business entities seeking consent from consumers, must present the information in a readable format, even on small screens. It should also be accessible to people with disabilities and use links consistent in size and font with the rest of the site. Furthermore, the information should be available in all languages in which the website is displayed.
2. Avoiding “dark patterns” – processes that lead users to choose one option over another. Examples of such patterns include a prominent and visible consent button next to a small and hidden decline button, pre-ticked checkboxes, lengthening the flow with multiple screens, and more.
3. Business entities must present details about the types of information they collect in the privacy policy, including: the ability to print the policy, a detailed description of the categories of information collected and details about them, a full description of the rights granted to consumers and how to exercise them, reference to browse privacy signals, and more.
4. Details about how to display a notice to consumers at the time of information collection, including: displaying a clear link or online form, detailing the categories of information collected and the purposes of collection, including a link to the relevant location in the privacy policy, and more.

Details about the content required when signing a contract with a service provider. Among other things, the contract must include:

• A definition of the specific business purpose for the processing of the information.
• A prohibition on the use of the information beyond the relationship between the parties.
• The right to assess the service providers’ compliance with the law.
• An assurance that the service provider can meet the requirements, and more.

The court’s decision to start enforcement proceedings, in addition to the general provisions of the Act already being enforced, is expected to lead to a significant increase in enforcement against companies that fall in the scope of the California Privacy Rights Act (CPRA).

***

Barnea Jaffa Lande’s Privacy, Data Protection and Cyber Department is at your service for any question regarding the adaptation of your business activity to the provisions of privacy laws in Israel, Europe, the United States, and other jurisdictions.

Dr. Avishay Klein is a partner and heads the department.

Adv. Masha Yudashkin is an associate in the department.