Final rules for California’s landmark privacy law get OK

The Office of Administrative Law (OAL) has approved final rules for California's 2018 privacy law, Attorney General Xavier Becerra announced Friday.

The California Consumer Privacy Act officially went into effect on Jan. 1. Becerra submitted the proposed regulations on June 1, and announced it could begin enforcing the law as of July 1. The rules were the result of 11 public meeting and multiple comment periods, the attorney general's office said.

The OAL also published six pages of "non-substantive changes for accuracy, consistency, and clarity." Many of these were typographical corrections or sought to clarify ambiguous language, including to the rules for collecting and selling users' personal information.

The law gave consumers significant new powers to limit what information is collected and shared about then via online platforms. Numerous technology companies and others have objected to the way the law was rolled out, claiming it didn't give them sufficient time to comply.

The law was the result of a compromise between legislators and Alastair Mactaggart, a wealthy investor turned privacy advocate. The founder of Californians for Consumer Privacy agreed to take a stronger initiative off of the 2018 ballot in exchange for lawmakers passing the rules.

But Mactaggart later expressed disappointment as the Legislature passed five follow-on measures in 2019. These include one-year exemptions for employment and business data, changes to the legal definitions of terms like "personal data" and "publicly available" and omitting some types of consumer information from the law's private rights of action.

This led Mactaggart to qualify an initiative for the fall ballot, Proposition 24, the Consumer Personal Information Law and Agency Initiative. This would strengthen consumers' ability to opt out of data sharing and to demand data be corrected or deleted. It would also put in place more protections for minors under 16.

-- Malcolm Maclachlan