California Privacy Agency Issues First Enforcement Advisory

On April 2, 2024, the Enforcement Division of the California Privacy Protection Agency issued its first Enforcement Advisory (No. 2024-01) (the Advisory). The Advisory addresses the obligation of businesses to practice data minimization, particularly when responding to and fulfilling consumer rights requests under the California Consumer Privacy Act (CCPA). As stated in the Advisory, its release was prompted by the agency's observation that some businesses are "asking consumers to provide excessive and unnecessary personal information" when responding to consumer rights requests.

Like many privacy laws, the CCPA provides consumers with the right to make various requests to businesses that handle their personal information, including requests to access, correct, and delete personal information; to opt out of the sale or "sharing" (which, under the CCPA, means transmitting to a third party to use for targeted advertising) of personal information; and to limit the use