The rule amendments [PDF], just approved by the American state’s Office of Administrative Law, were proposed last October after a set of initial rules for enforcing the California Consumer Privacy Act (CCPA) were adopted last August, a month after CCPA enforcement began.
The CCPA amendments:
- Clarify that businesses operating offline need to provide a way to opt-out of data sales.
- Establish a standard Opt-Out Icon for notice and consent of data sales.
- Prohibit designs that impair or subvert a consumer’s choice to opt-out.
- Require that opting out takes no more steps or clicks than opting in.
- Ban confusing language, like the double negative “Don’t not sell my information,” when presenting an opt-out choice.
- Forbid asking for personal information not necessary to carry out an opt-out request.
Research published in 2019 found 22 companies selling manipulative interface design or dark patterns as a service and found 1,841 examples on 1,267 websites employing these dubious techniques out of 11,000 surveyed.