to Becerra’s office in December on the first round of draft regulations. They are particularly concerned about requirements that allow consumers to request a copy of all of their personal information that might have been collected by a company or request that the company delete those data entirely, Rector said.“The draft rules imposed on businesses entirely new record-keeping obligations, notice requirements, and verification rules, among many other novel requirements,” the letter reads.
Another point of contention is that the law creates restrictions around the sale of personal data, but it does not clearly lay out what counts as selling data. “That has produced anarchy among businesses in California, with each one possibly interpreting it differently,” Eric Goldman, a Santa Clara University School of Law professor who co-directs the school’s High Tech Law Institute,It also requires companies that sell personal data to third parties to provide a prominent opt-out button.
“What is covered as a ‘sale’ under California law is not yet clear, but we currently do not ‘sell’ your information as we understand it,”