CPPA To Propose Changes To Privacy Policy Requirements

While the California Privacy Protection Agency (CPPA) Board's attention during its December 8 public meeting was mainly focused on preliminary draft regulations on automated decisionmaking technology (ADMT), risk assessments, and cybersecurity audits, the Board also decided to begin a formal process to revise its existing regulations.

The proposed changes emphasize the need to give consumers a "meaningful understanding" of personal information practices and the CPPA's focus on providing information about data practices before consumers engage with a business. These changes are less far-reaching than the ADMT, risk assessment, and audit proposals, but they could affect how businesses make disclosures in their privacy policies and are likely to be finalized on a relatively short timeline.