-
Notifications
You must be signed in to change notification settings - Fork 287
/
Copy pathccpa_regulations.yaml
5522 lines (5522 loc) · 307 KB
/
ccpa_regulations.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
urn: urn:intuitem:risk:library:ccpa_regulations
locale: en
ref_id: CCPA Regulations
name: California Consumer Privacy Act Regulations (CCPA)
description: "The California Consumer Privacy Act of 2018 (CCPA) gives consumers more\
\ control over the personal information that businesses collect about them and the\
\ CCPA regulations provide guidance on how to implement the law. Effective 1/1/2024\
\ \u2013 AB 947 and AB 1194 updates\nhttps://cppa.ca.gov/regulations/pdf/cppa_regs.pdf"
copyright: State of California
version: 1
publication_date: 2024-07-03
provider: State of California
packager: intuitem
objects:
framework:
urn: urn:intuitem:risk:framework:ccpa_regulations
ref_id: CCPA Regulations
name: California Consumer Privacy Act Regulations (CCPA)
description: "The California Consumer Privacy Act of 2018 (CCPA) gives consumers\
\ more control over the personal information that businesses collect about them\
\ and the CCPA regulations provide guidance on how to implement the law. Effective\
\ 1/1/2024 \u2013 AB 947 and AB 1194 updates\nhttps://cppa.ca.gov/regulations/pdf/cppa_regs.pdf"
requirement_nodes:
- urn: urn:intuitem:risk:req_node:ccpa_regulations:chapter-1
assessable: false
depth: 1
ref_id: CHAPTER 1
name: ' CALIFORNIA CONSUMER PRIVACY ACT REGULATIONS'
- urn: urn:intuitem:risk:req_node:ccpa_regulations:article-1
assessable: false
depth: 2
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:chapter-1
ref_id: ARTICLE 1
name: GENERAL PROVISIONS
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7000
assessable: false
depth: 3
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:article-1
ref_id: '7000'
name: Title and Scope.
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7000-a
assessable: false
depth: 4
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:7000
ref_id: 7000-a
description: "This Chapter shall be known as the California Consumer Privacy\
\ Act Regulations. It may be cited as such and will be referred to in this\
\ Chapter as \u201Cthese regulations.\u201D These regulations govern compliance\
\ with the California Consumer Privacy Act and do not limit any other rights\
\ that consumers may have."
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7000-b
assessable: false
depth: 4
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:7000
ref_id: 7000-b
description: A violation of these regulations shall constitute a violation of
the CCPA and be subject to the remedies provided for therein.
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7001
assessable: false
depth: 3
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:article-1
ref_id: '7001'
name: Definitions.
- urn: urn:intuitem:risk:req_node:ccpa_regulations:node8
assessable: false
depth: 4
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:7001
description: 'In addition to the definitions set forth in Civil Code section
1798.140, for purposes of these regulations:'
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7001-a
assessable: false
depth: 5
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:node8
ref_id: 7001-a
description: " \u201CAgency\u201D means the California Privacy Protection Agency\
\ established by Civil Code section 1798.199.10 et seq."
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7001-b
assessable: false
depth: 5
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:node8
ref_id: 7001-b
description: "\u201CAlternative Opt-out Link\u201D means the alternative opt-out\
\ link that a business may provide instead of posting the two separate \u201C\
Do Not Sell or Share My Personal Information\u201D and \u201CLimit the Use\
\ of My Sensitive Personal Information\u201D links as set forth in Civil Code\
\ section 1798.135, subdivision (a)(3), and specified in section 7015."
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7001-c
assessable: false
depth: 5
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:node8
ref_id: 7001-c
description: "\u201CAttorney General\u201D means the California Attorney General\
\ or any officer or employee of the California Department of Justice acting\
\ under the authority of the California Attorney General."
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7001-d
assessable: false
depth: 5
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:node8
ref_id: 7001-d
description: "\u201CAuthorized agent\u201D means a natural person or a business\
\ entity that a consumer has authorized to act on their behalf subject to\
\ the requirements set forth in section 7063."
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7001-e
assessable: false
depth: 5
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:node8
ref_id: 7001-e
description: "\u201CCategories of sources\u201D means types or groupings of\
\ persons or entities from which a business collects personal information\
\ about consumers, described with enough particularity to provide consumers\
\ with a meaningful understanding of the type of person or entity. They may\
\ include the consumer directly, advertising networks, internet service providers,\
\ data analytics providers, government entities, operating systems and platforms,\
\ social networks, and data brokers."
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7001-f
assessable: false
depth: 5
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:node8
ref_id: 7001-f
description: "\u201CCategories of third parties\u201D means types or groupings\
\ of third parties with whom the business shares personal information, described\
\ with enough particularity to provide CPPA Page 4 of 67 consumers with\
\ a meaningful understanding of the type of third party. They may include\
\ advertising networks, internet service providers, data analytics providers,\
\ government entities, operating systems and platforms, social networks,\
\ and data brokers."
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7001-g
assessable: false
depth: 5
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:node8
ref_id: 7001-g
description: "\u201CCCPA\u201D means the California Consumer Privacy Act of\
\ 2018, Civil Code section 1798.100 et seq."
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7001-h
assessable: false
depth: 5
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:node8
ref_id: 7001-h
description: "\u201CCOPPA\u201D means the Children\u2019s Online Privacy Protection\
\ Act, 15 U.S.C. sections 6501 to 6506 and 16 Code of Federal Regulations\
\ part 312."
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7001-i
assessable: false
depth: 5
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:node8
ref_id: 7001-i
description: " \u201CDisproportionate effort\u201D within the context of a business,\
\ service provider, contractor, or third party responding to a consumer request\
\ means the time and/or resources expended by the business, service provider,\
\ contractor, or third party to respond to the individualized request significantly\
\ outweighs the reasonably foreseeable impact to the consumer by not responding,\
\ taking into account applicable circumstances, such as the size of the business,\
\ service provider, contractor, or third party, the nature of the request,\
\ and the technical limitations impacting their ability to respond. For example,\
\ responding to a consumer request to know may require disproportionate effort\
\ when the personal information that is the subject of the request is not\
\ in a searchable or readily-accessible format, is maintained only for legal\
\ or compliance purposes, is not sold or used for any commercial purpose,\
\ and there is no reasonably foreseeable material impact to the consumer\
\ by not responding. By contrast, the impact to the consumer of denying a\
\ request to correct inaccurate information that the business uses and/or\
\ sells may outweigh the burden on the business, service provider, contractor,\
\ or third party in honoring the request when the reasonably foreseeable\
\ consequence of denying the request would be the denial of services or opportunities\
\ to the consumer. A business, service provider, contractor, or third party\
\ that has failed to put in place adequate processes and procedures to receive\
\ and process consumer requests in accordance with the CCPA and these regulations\
\ cannot claim that responding to a consumer\u2019s request requires disproportionate\
\ effort."
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7001-j
assessable: false
depth: 5
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:node8
ref_id: 7001-j
description: "\u201CEmployment benefits\u201D means retirement, health, and\
\ other benefit programs, services, or products to which consumers and their\
\ dependents or their beneficiaries receive access through the consumer\u2019\
s employer."
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7001-k
assessable: false
depth: 5
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:node8
ref_id: 7001-k
description: "\u201CEmployment-related information\u201D means personal information\
\ that is collected by the business about a natural person for the reasons\
\ identified in Civil Code section 1798.145, subdivision (m)(1). The collection\
\ of employment-related information, including for the purpose of administering\
\ employment benefits, shall be considered a business purpose."
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7001-l
assessable: false
depth: 5
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:node8
ref_id: 7001-l
description: "\u201CFinancial incentive\u201D means a program, benefit, or other\
\ offering, including payments to consumers, for the collection, retention,\
\ sale, or sharing of personal information. Price or service differences\
\ are types of financial incentives."
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7001-m
assessable: false
depth: 5
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:node8
ref_id: 7001-m
description: "\u201CFirst party\u201D means a consumer-facing business with\
\ which the consumer intends and expects to interact."
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7001-n
assessable: false
depth: 5
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:node8
ref_id: 7001-n
description: "\u201CFrictionless manner\u201D means a business\u2019s processing\
\ of an opt-out preference signal that complies with the requirements set\
\ forth in section 7025, subsection (f)."
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7001-o
assessable: false
depth: 5
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:node8
ref_id: 7001-o
description: "\u201CInformation practices\u201D means practices regarding the\
\ collection, use, disclosure, sale, sharing, and retention of personal information"
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7001-p
assessable: false
depth: 5
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:node8
ref_id: 7001-p
description: "\u201CNonbusiness\u201D means a person or entity that does not\
\ meet the definition of a \u201Cbusiness\u201D as defined in Civil Code\
\ section 1798.140, subdivision (d). For example, non-profits and government\
\ entities are nonbusinesses because \u201Cbusiness\u201D is defined, among\
\ other things, to include only entities \u201Corganized or operated for\
\ the profit or financial benefit of its shareholders or other owners.\u201D"
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7001-q
assessable: false
depth: 5
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:node8
ref_id: 7001-q
description: "\u201CNotice at Collection\u201D means the notice given by a business\
\ to a consumer at or before the point at which a business collects personal\
\ information from the consumer as required by Civil Code section 1798.100,\
\ subdivisions (a) and (b), and specified in these regulations."
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7001-r
assessable: false
depth: 5
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:node8
ref_id: 7001-r
description: "\u201CNotice of Right to Limit\u201D means the notice given by\
\ a business informing consumers of their right to limit the use or disclosure\
\ of the consumer\u2019s sensitive personal information as required by Civil\
\ Code sections 1798.121 and 1798.135 and specified in these regulations."
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7001-s
assessable: false
depth: 5
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:node8
ref_id: 7001-s
description: " \u201CNotice of Right to Opt-out of Sale/Sharing\u201D means\
\ the notice given by a business informing consumers of their right to opt-out\
\ of the sale or sharing of their personal information as required by Civil\
\ Code sections 1798.120 and 1798.135 and specified in these regulations."
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7001-t
assessable: false
depth: 5
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:node8
ref_id: 7001-t
description: "\u201CNotice of Financial Incentive\u201D means the notice given\
\ by a business explaining each financial incentive or price or service difference\
\ as required by Civil Code section 1798.125, subdivision (b), and specified\
\ in these regulations."
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7001-u
assessable: false
depth: 5
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:node8
ref_id: 7001-u
description: "\u201COpt-out preference signal\u201D means a signal that is sent\
\ by a platform, technology, or mechanism, on behalf of the consumer, that\
\ communicates the consumer choice to opt- out of the sale and sharing of\
\ personal information and that complies with the requirements set forth\
\ in section 7025, subsection (b)."
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7001-v
assessable: false
depth: 5
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:node8
ref_id: 7001-v
description: "\u201CPrice or service difference\u201D means (1) any difference\
\ in the price or rate charged for any goods or services to any consumer related\
\ to the collection, retention, sale, or sharing of personal information,\
\ or (2) any difference in the level or quality of any goods or services offered\
\ to any consumer related to the collection, retention, sale, or sharing of\
\ personal information, including the denial of goods or services to the consumer."
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7001-w
assessable: false
depth: 5
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:node8
ref_id: 7001-w
description: "\u201CPrivacy policy,\u201D as referred to in Civil Code sections\
\ 1798.130, subdivision (a)(5), and 1798.135, subdivision (c)(2), means the\
\ statement that a business shall make available to consumers describing\
\ the business\u2019s online and offline information practices, and the rights\
\ of consumers regarding their own personal information."
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7001-x
assessable: false
depth: 5
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:node8
ref_id: 7001-x
description: "\u201CRequest to correct\u201D means a consumer request that a\
\ business correct inaccurate personal information that it maintains about\
\ the consumer, pursuant to Civil Code section 1798.106."
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7001-y
assessable: false
depth: 5
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:node8
ref_id: 7001-y
description: "\u201CRequest to delete\u201D means a consumer request that a\
\ business delete personal information about the consumer that the business\
\ has collected from the consumer, pursuant to Civil Code section 1798.105."
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7001-z
assessable: false
depth: 5
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:node8
ref_id: 7001-z
description: "\u201CRequest to know\u201D means a consumer request that a business\
\ disclose personal information that it has collected about the consumer\
\ pursuant to Civil Code sections 1798.110 or 1798.115. It includes a request\
\ for any or all of the following:"
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7001-z.1
assessable: false
depth: 6
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:7001-z
ref_id: 7001-z.1
description: Specific pieces of personal information that a business has collected
about the consumer;
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7001-z.2
assessable: false
depth: 6
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:7001-z
ref_id: 7001-z.2
description: Categories of personal information it has collected about the consumer;
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7001-z.3
assessable: false
depth: 6
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:7001-z
ref_id: 7001-z.3
description: Categories of sources from which the personal information is collected;
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7001-z.4
assessable: false
depth: 6
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:7001-z
ref_id: 7001-z.4
description: Categories of personal information that the business sold or disclosed
for a business purpose about the consumer;
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7001-z.5
assessable: false
depth: 6
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:7001-z
ref_id: 7001-z.5
description: Categories of third parties to whom the personal information was
sold or disclosed for a business purpose; and
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7001-z.6
assessable: false
depth: 6
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:7001-z
ref_id: 7001-z.6
description: The business or commercial purpose for collecting or selling personal
information.
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7001-aa
assessable: false
depth: 5
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:node8
ref_id: 7001-aa
description: "\u201CRequest to limit\u201D means a consumer request that a business\
\ limit the use and disclosure of the consumer\u2019s sensitive personal\
\ information, pursuant to Civil Code section 1798.121, subdivision (a)."
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7001-bb
assessable: false
depth: 5
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:node8
ref_id: 7001-bb
description: "\u201CRequest to opt-in to sale/sharing\u201D means an action\
\ demonstrating that the consumer has consented to the business\u2019s sale\
\ or sharing of personal information about the consumer by a parent or guardian\
\ of a consumer less than 13 years of age or by a consumer at least 13 years\
\ of age."
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7001-cc
assessable: false
depth: 5
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:node8
ref_id: 7001-cc
description: "\u201CRequest to opt-out of sale/sharing\u201D means a consumer\
\ request that a business neither sell nor share the consumer\u2019s personal\
\ information to third parties, pursuant to Civil Code section 1798.120,\
\ subdivision (a)."
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7001-dd
assessable: false
depth: 5
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:node8
ref_id: 7001-dd
description: "\u201CRight to correct\u201D means the consumer\u2019s right to\
\ request that a business correct inaccurate personal information that it\
\ maintains about the consumer as set forth in Civil Code section 1798.106."
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7001-ee
assessable: false
depth: 5
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:node8
ref_id: 7001-ee
description: "\u201CRight to delete\u201D means the consumer\u2019s right to\
\ request that a business delete any personal information about the consumer\
\ that the business has collected from the consumer as set forth in Civil\
\ Code section 1798.105."
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7001-ff
assessable: false
depth: 5
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:node8
ref_id: 7001-ff
description: "\u201CRight to know\u201D means the consumer\u2019s right to request\
\ that a business disclose personal information that it has collected, sold,\
\ or shared about the consumer as set forth in Civil Code sections 1798.110\
\ and 1798.115."
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7001-gg
assessable: false
depth: 5
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:node8
ref_id: 7001-gg
description: "\u201CRight to limit\u201D means the consumer\u2019s right to\
\ request that a business limit the use and disclosure of a consumer\u2019\
s sensitive personal information as set forth in Civil Code section 1798.121."
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7001-hh
assessable: false
depth: 5
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:node8
ref_id: 7001-hh
description: "\u201CRight to opt-out of sale/sharing\u201D means the consumer\u2019\
s right to direct a business that sells or shares personal information about\
\ the consumer to third parties to stop doing so as set forth in Civil Code\
\ section 1798.120."
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7001-ii
assessable: false
depth: 5
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:node8
ref_id: 7001-ii
description: "\u201CSigned\u201D means that the written attestation, declaration,\
\ or permission has either been physically signed or provided electronically\
\ in accordance with the Uniform Electronic Transactions Act, Civil Code\
\ section 1633.1 et seq."
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7001-jj
assessable: false
depth: 5
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:node8
ref_id: 7001-jj
description: "\u201CThird-party identity verification service\u201D means a\
\ security process offered by an independent third party that verifies the\
\ identity of the consumer making a request to the business. Third-party\
\ identity verification services are subject to the requirements set forth\
\ in Article 5 regarding requests to delete, requests to correct, or requests\
\ to know."
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7001-kk
assessable: false
depth: 5
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:node8
ref_id: 7001-kk
description: "\u201CUnstructured\u201D as it relates to personal information\
\ means personal information that is not organized in a pre-defined manner\
\ and could not be retrieved or organized in a pre-defined manner without\
\ disproportionate effort on behalf of the business, service provider, contractor,\
\ or third party."
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7001-ll
assessable: false
depth: 5
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:node8
ref_id: 7001-ll
description: "\u201CValue of the consumer\u2019s data\u201D means the value\
\ provided to the business by the consumer\u2019s data as calculated under\
\ section 7081."
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7001-mm
assessable: false
depth: 5
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:node8
ref_id: 7001-mm
description: "\u201CVerify\u201D means to determine that the consumer making\
\ a request to delete, request to correct, or request to know is the consumer\
\ about whom the business has collected information, or if that consumer\
\ is less than 13 years of age, the consumer\u2019s parent or legal guardian."
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7002
assessable: false
depth: 3
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:article-1
ref_id: '7002'
name: Restrictions on the Collection and Use of Personal Information.
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7002-a
assessable: false
depth: 4
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:7002
ref_id: 7002-a
description: "In accordance with Civil Code section 1798.100, subdivision (c),\
\ a business\u2019s collection, use, retention, and/or sharing of a consumer\u2019\
s personal information shall be reasonably necessary and proportionate to\
\ achieve:"
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7002-a.1
assessable: true
depth: 5
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:7002-a
ref_id: 7002-a.1
description: The purpose(s) for which the personal information was collected
or processed, which shall comply with the requirements set forth in subsection
(b); or
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7002-a.2
assessable: true
depth: 5
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:7002-a
ref_id: 7002-a.2
description: Another disclosed purpose that is compatible with the context in
which the personal information was collected, which shall comply with the
requirements set forth in subsection (c).
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7002-b
assessable: true
depth: 4
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:7002
ref_id: 7002-b
description: "The purpose(s) for which the personal information was collected\
\ or processed shall be consistent with the reasonable expectations of the\
\ consumer(s) whose personal information is collected or processed. The consumer\u2019\
s (or consumers\u2019) reasonable expectations concerning the purpose for\
\ which their personal information will be collected or processed shall be\
\ based on the following:"
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7002-b.1
assessable: true
depth: 5
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:7002-b
ref_id: 7002-b.1
description: "The relationship between the consumer(s) and the business. For\
\ example, if the consumer is intentionally interacting with the business\
\ on its website to purchase a good or service, the consumer likely expects\
\ that the purpose for collecting or processing the personal information\
\ is to provide that good or service. By contrast, for example, the consumer\
\ of a business\u2019s mobile flashlight application would not expect the\
\ business to collect the consumer\u2019s geolocation information to provide\
\ the flashlight service."
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7002-b.2
assessable: true
depth: 5
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:7002-b
ref_id: 7002-b.2
description: "The type, nature, and amount of personal information that the\
\ business seeks to collect or process. For example, if a business\u2019\
s mobile communication application requests access to the consumer\u2019\
s contact list in order to call a specific individual, the consumer who is\
\ providing their contact list likely expects that the purpose of the business\u2019\
s use of that contact list will be to connect the consumer with the specific\
\ contact they selected. Similarly, if a business collects the consumer\u2019\
s fingerprint in connection with setting up the security feature of unlocking\
\ the device using the fingerprint, the consumer likely expects that the\
\ business\u2019s use of the consumer\u2019s fingerprint is only for the\
\ purpose of unlocking their mobile device."
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7002-b.3
assessable: true
depth: 5
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:7002-b
ref_id: 7002-b.3
description: "The source of the personal information and the business\u2019\
s method for collecting or processing it. For example, if the consumer is\
\ providing their personal information directly to the business while using\
\ the business\u2019s product or service, the consumer likely expects that\
\ the business will use the personal information to provide that product\
\ or service. However, the consumer may not expect that the business will\
\ use that same personal information for a different product or service offered\
\ by the business or the business\u2019s subsidiary."
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7002-b.4
assessable: true
depth: 5
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:7002-b
ref_id: 7002-b.4
description: "The specificity, explicitness, prominence, and clarity of disclosures\
\ to the consumer(s) about the purpose for collecting or processing their\
\ personal information, such as in the Notice at Collection and in the marketing\
\ materials to the consumer(s) about the business\u2019s good or service.\
\ For example, the consumer who receives a pop-up notice that the business\
\ wants to collect the consumer\u2019s phone number to verify their identity\
\ when they log in likely expects that the business will use their phone number\
\ for the purpose of verifying the consumer\u2019s identity and not for marketing\
\ purposes. Similarly, the consumer may expect that a mobile application\
\ that markets itself as a service that finds gas prices near the consumer\u2019\
s location will collect and use the consumer\u2019s geolocation information\
\ for that specific purpose when they are using the service"
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7002-b.5
assessable: true
depth: 5
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:7002-b
ref_id: 7002-b.5
description: "The degree to which the involvement of service providers, contractors,\
\ third parties, or other entities in the collecting or processing of personal\
\ information is apparent to CPPA Page 9 of 67 the consumer(s). For example,\
\ the consumer likely expects an online retailer\u2019s disclosure of the\
\ consumer\u2019s name and address to a delivery service provider in order\
\ for that service provider to deliver a purchased product, because that\
\ service provider\u2019s involvement is apparent to the consumer. By contrast,\
\ the consumer may not expect the disclosure of personal information to a\
\ service provider if the consumer is not directly interacting with the service\
\ provider or the service provider\u2019s role in the processing is not apparent\
\ to the consumer."
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7002-c
assessable: false
depth: 4
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:7002
ref_id: 7002-c
description: 'Whether another disclosed purpose is compatible with the context
in which the personal information was collected shall be based on the following:'
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7002-c.1
assessable: true
depth: 5
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:7002-c
ref_id: 7002-c.1
description: At the time of collection of the personal information, the reasonable
expectations of the consumer(s) whose personal information is collected or
processed concerning the purpose for which their personal information will
be collected or processed, based on the factors set forth in subsection (b).
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7002-c.2
assessable: true
depth: 5
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:7002-c
ref_id: 7002-c.2
description: "The other disclosed purpose for which the business seeks to further\
\ collect or process the consumer\u2019s personal information, including\
\ whether it is a business purpose listed in Civil Code section 1798.140,\
\ subdivisions (e)(1) through (e)(8)."
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7002-c.3
assessable: true
depth: 5
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:7002-c
ref_id: 7002-c.3
description: "The strength of the link between subsection (c)(1) and subsection\
\ (c)(2). For example, a strong link exists between the consumer\u2019s reasonable\
\ expectations that the personal information will be used to provide them\
\ with a requested service at the time of collection, and the use of the\
\ information to repair errors that impair the intended functionality of\
\ that requested service. This would weigh in favor of compatibility. By\
\ contrast, for example, a weak link exists between the consumer\u2019s reasonable\
\ expectations that the personal information will be collected to provide\
\ a requested cloud storage service at the time of collection, and the use\
\ of the information to research and develop an unrelated facial recognition\
\ service."
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7002-d
assessable: true
depth: 4
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:7002
ref_id: 7002-d
description: "For each purpose identified in compliance with subsection (a)(1)\
\ or (a)(2), the collection, use, retention, and/or sharing of a consumer\u2019\
s personal information to achieve that purpose shall be reasonably necessary\
\ and proportionate. The business\u2019s collection, use, retention, and/or\
\ sharing of a consumer\u2019s personal information shall also be reasonably\
\ necessary and proportionate to achieve any purpose for which the business\
\ obtains the consumer\u2019s consent in compliance with subsection (e).\
\ Whether a business\u2019s collection, use, retention, and/or sharing of\
\ a consumer\u2019s personal information is reasonably necessary and proportionate\
\ to achieve the purpose identified in compliance with subsection (a)(1)\
\ or (a)(2), or any purpose for which the business obtains consent, shall\
\ be based on the following:"
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7002-d.1
assessable: true
depth: 5
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:7002-d
ref_id: 7002-d.1
description: "The minimum personal information that is necessary to achieve\
\ the purpose identified in compliance with subsection (a)(1) or (a)(2),\
\ or any purpose for which the business obtains consent. For example, to\
\ complete an online purchase and send an email confirmation of the purchase\
\ to the consumer, an online retailer may need the consumer\u2019s order\
\ information, payment and shipping information, and email address."
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7002-d.2
assessable: true
depth: 5
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:7002-d
ref_id: 7002-d.2
description: "The possible negative impacts on consumers posed by the business\u2019\
s collection or processing of the personal information. For example, a possible\
\ negative impact of collecting precise geolocation information is that it\
\ may reveal other sensitive personal information about the consumer, such\
\ as health information based on visits to healthcare providers."
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7002-d.3
assessable: true
depth: 5
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:7002-d
ref_id: 7002-d.3
description: The existence of additional safeguards for the personal information
to specifically address the possible negative impacts on consumers considered
by the business in subsection (d)(2). For example, a business may consider
encryption or automatic deletion of personal information within a specific
window of time as potential safeguards
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7002-e
assessable: true
depth: 4
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:7002
ref_id: 7002-e
description: "A business shall obtain the consumer\u2019s consent in accordance\
\ with section 7004 before collecting or processing personal information\
\ for any purpose that does not meet the requirements set forth in subsection\
\ (a)."
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7002-f
assessable: true
depth: 4
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:7002
ref_id: 7002-f
description: A business shall not collect categories of personal information
other than those disclosed in its Notice at Collection in accordance with
the CCPA and section 7012. If the business intends to collect additional
categories of personal information or intends to use the personal information
for additional purposes that are incompatible with the disclosed purpose
for which the personal information was collected, the business shall provide
a new Notice at Collection. However, any additional collecting or processing
of personal information shall comply with subsection (a).
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7003
assessable: false
depth: 3
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:article-1
ref_id: '7003'
name: Requirements for Disclosures and Communications to Consumers
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7003-a
assessable: true
depth: 4
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:7003
ref_id: 7003-a
description: Disclosures and communications to consumers shall be easy to read
and understandable to consumers. For example, they shall use plain, straightforward
language and avoid technical or legal jargon.
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7003-b
assessable: false
depth: 4
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:7003
ref_id: 7003-b
description: 'Disclosures required under Article 2 shall also:'
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7003-b.1
assessable: true
depth: 5
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:7003-b
ref_id: 7003-b.1
description: Use a format that makes the disclosure readable, including on smaller
screens, if applicable.
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7003-b.2
assessable: true
depth: 5
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:7003-b
ref_id: 7003-b.2
description: Be available in the languages in which the business in its ordinary
course provides contracts, disclaimers, sale announcements, and other information
to consumers in California.
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7003-b.3
assessable: true
depth: 5
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:7003-b
ref_id: 7003-b.3
description: Be reasonably accessible to consumers with disabilities. For notices
provided online, the business shall follow generally recognized industry
standards, such as the Web Content Accessibility Guidelines, version 2.1
of June 5, 2018, from the World Wide Web Consortium, incorporated herein
by reference. In other contexts, the business shall provide information on
how a consumer with a disability may access the policy in an alternative
format.
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7003-c
assessable: true
depth: 4
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:7003
ref_id: 7003-c
description: For websites, a conspicuous link required under the CCPA or these
regulations shall appear in a similar manner as other similarly-posted links
used by the business on its homepage(s). For example, the business shall
use a font size and color that is at least the approximate size or color
as other links next to it that are used by the business on its homepage(s).
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7003-d
assessable: true
depth: 4
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:7003
ref_id: 7003-d
description: "For mobile applications, a conspicuous link shall be included\
\ in the business\u2019s privacy policy, which must be accessible through\
\ the mobile application\u2019s platform page or download page. It may also\
\ be accessible through a link within the application, such as through the\
\ application\u2019s settings menu."
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7004
assessable: false
depth: 3
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:article-1
ref_id: '7004'
name: Requirements for Methods for Submitting CCPA Requests and Obtaining Consumer Consent
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7004-a
assessable: true
depth: 4
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:7004
ref_id: 7004-a
description: Except as expressly allowed by the CCPA and these regulations,
businesses shall design and implement methods for submitting CCPA requests
and obtaining consumer consent that incorporate the following principles.
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7004-a.1
assessable: true
depth: 5
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:7004-a
ref_id: 7004-a.1
description: Easy to understand. The methods shall use language that is easy
for consumers to read and understand. When applicable, they shall comply
with the requirements for disclosures to consumers set forth in section 7003.
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7004-a.2
assessable: true
depth: 5
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:7004-a
ref_id: 7004-a.2
description: "Symmetry in choice. The path for a consumer to exercise a more\
\ privacy-protective option shall not be longer or more difficult or time-consuming\
\ than the path to exercise a less privacy-protective option because that\
\ would impair or interfere with the consumer\u2019s ability to make a choice.\
\ Illustrative examples follow."
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7004-a.2.a
assessable: true
depth: 6
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:7004-a.2
ref_id: 7004-a.2.A
description: "It is not symmetrical when a business\u2019s process for submitting\
\ a request to opt- out of sale/sharing requires more steps than that business\u2019\
s process for a consumer to opt-in to the sale of personal information after\
\ having previously opted out. The number of steps for submitting a request\
\ to opt-out of sale/sharing is measured from when the consumer clicks on\
\ the \u201CDo Not Sell or Share My Personal Information\u201D link to completion\
\ of the request. The number of steps for submitting a request to opt-in\
\ to the sale of personal information is measured from the first indication\
\ by the consumer to the business of their interest to opt-in to completion\
\ of the request."
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7004-a.2.b
assessable: true
depth: 6
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:7004-a.2
ref_id: 7004-a.2.B
description: "A choice to opt-in to the sale of personal information that provides\
\ only the two options, \u201CYes\u201D and \u201CAsk me later,\u201D is\
\ not equal or symmetrical because there is no option to decline the opt-in.\
\ \u201CAsk me later\u201D implies that the consumer has not declined but\
\ delayed the decision and that the business will continue to ask the consumer\
\ to opt-in. Framing the consumer\u2019s options in this manner impairs the\
\ CPPA Page 12 of 67 consumer\u2019s ability to make a choice. An equal\
\ or symmetrical choice could be between \u201CYes\u201D and \u201CNo.\u201D"
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7004-a.2.c
assessable: true
depth: 6
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:7004-a.2
ref_id: 7004-a.2.C
description: "A website banner that provides only the two options, \u201CAccept\
\ All\u201D and \u201CMore Information,\u201D or, \u201CAccept All\u201D\
\ and \u201CPreferences,\u201D when seeking the consumer\u2019s consent to\
\ use their personal information is not equal or symmetrical because the\
\ method allows the consumer to \u201CAccept All\u201D in one step, but requires\
\ the consumer to take additional steps to exercise their rights over their\
\ personal information. Framing the consumer\u2019s options in this manner\
\ impairs the consumer\u2019s ability to make a choice. An equal or symmetrical\
\ choice could be between \u201CAccept All\u201D and \u201CDecline All.\u201D"
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7004-a.3
assessable: true
depth: 5
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:7004-a
ref_id: 7004-a.3
description: "Avoid language or interactive elements that are confusing to the\
\ consumer. The methods should not use double negatives. Toggles or buttons\
\ must clearly indicate the consumer\u2019s choice. Illustrative examples\
\ follow."
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7004-a.3.a
assessable: true
depth: 6
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:7004-a.3
ref_id: 7004-a.3.A
description: "Giving the choice of \u201CYes\u201D or \u201CNo\u201D next to\
\ the statement \u201CDo Not Sell or Share My Personal Information\u201D\
\ is a double negative and a confusing choice for a consumer."
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7004-a.3.b
assessable: true
depth: 6
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:7004-a.3
ref_id: 7004-a.3.B
description: "Toggles or buttons that state \u201Con\u201D or \u201Coff\u201D\
\ may be confusing to a consumer and may require further clarifying language."
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7004-a.3.c
assessable: true
depth: 6
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:7004-a.3
ref_id: 7004-a.3.C
description: "Unintuitive placement of buttons to confirm a consumer\u2019s\
\ choice may be confusing to the consumer. For example, it is confusing to\
\ the consumer when a business at first consistently offers choices in the\
\ order of \u201CYes,\u201D then \u201CNo,\u201D but then offers choices\
\ in the opposite order\u2014 \u201CNo,\u201D then \u201CYes\u201D \u2014\
when asking the consumer something that would contravene the consumer\u2019\
s expectation."
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7004-a.4
assessable: true
depth: 5
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:7004-a
ref_id: 7004-a.4
description: "Avoid choice architecture that impairs or interferes with the\
\ consumer\u2019s ability to make a choice. Businesses should also not design\
\ their methods in a manner that would impair the consumer\u2019s ability\
\ to exercise their choice because consent must be freely given, specific,\
\ informed, and unambiguous. Illustrative examples follow."
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7004-a.4.a
assessable: true
depth: 6
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:7004-a.4
ref_id: 7004-a.4.A
description: "Requiring the consumer to click through disruptive screens before\
\ they are able to submit a request to opt-out of sale/sharing is a choice\
\ architecture that impairs or interferes with the consumer\u2019s ability\
\ to exercise their choice"
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7004-a.4.b
assessable: true
depth: 6
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:7004-a.4
ref_id: 7004-a.4.B
description: "Bundling choices so that the consumer is only offered the option\
\ to consent to using personal information for purposes that meet the requirements\
\ set forth in section 7002, subsection (a), together with purposes that\
\ are incompatible with the context in which the personal information was\
\ collected is a choice architecture that impairs or interferes with the\
\ consumer\u2019s ability to make a choice. For example, a business that\
\ provides a location-based service, such as a mobile application that finds\
\ gas prices near the consumer\u2019s location, shall not CPPA Page 13 of\
\ 67 require the consumer to consent to incompatible uses (e.g., sale of\
\ the consumer\u2019s geolocation to data brokers) together with a reasonably\
\ necessary and proportionate use of geolocation information for providing\
\ the location- based services, which does not require consent. This type\
\ of choice architecture does not allow consent to be freely given, specific,\
\ informed, or unambiguous because it requires the consumer to consent to\
\ incompatible uses in order to obtain the expected service. The business\
\ should provide the consumer a separate option to consent to the business\u2019\
s use of personal information that does not meet the requirements set forth\
\ in section 7002, subsection (a)."
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7004-a.5
assessable: true
depth: 5
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:7004-a
ref_id: 7004-a.5
description: "Easy to execute. The business shall not add unnecessary burden\
\ or friction to the process by which the consumer submits a CCPA request.\
\ Methods should be tested to ensure that they are functional and do not\
\ undermine the consumer\u2019s choice to submit the request. Illustrative\
\ examples follow."
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7004-a.5.a
assessable: true
depth: 6
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:7004-a.5
ref_id: 7004-a.5.A
description: "Upon clicking the \u201CDo Not Sell or Share My Personal Information\u201D\
\ link, the business shall not require the consumer to search or scroll through\
\ the text of a privacy policy or similar document or webpage to locate the\
\ mechanism for submitting a request to opt-out of sale/sharing."
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7004-a.5.b
assessable: true
depth: 6
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:7004-a.5
ref_id: 7004-a.5.B
description: A business that knows of, but does not remedy, circular or broken
links, or nonfunctional email addresses, such as inboxes that are not monitored
or have aggressive filters that screen emails from the public, may be in
violation of this regulation.
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7004-a.5.c
assessable: true
depth: 6
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:7004-a.5
ref_id: 7004-a.5.C
description: Businesses that require the consumer to unnecessarily wait on a
webpage as the business processes the request may be in violation of this
regulation.
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7004-b
assessable: true
depth: 4
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:7004
ref_id: 7004-b
description: "A method that does not comply with subsection (a) may be considered\
\ a dark pattern. Any agreement obtained through the use of dark patterns\
\ shall not constitute consumer consent. For example, a business that uses\
\ dark patterns to obtain consent from a consumer to sell their personal\
\ information shall be in the position of never having obtained the consumer\u2019\
s consent to do so."
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7004-c
assessable: true
depth: 4
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:7004
ref_id: 7004-c
description: "A user interface is a dark pattern if the interface has the effect\
\ of substantially subverting or impairing user autonomy, decisionmaking,\
\ or choice. A business\u2019s intent in designing the interface is not determinative\
\ in whether the user interface is a dark pattern, but a factor to be considered.\
\ If a business did not intend to design the user interface to subvert or\
\ impair user choice, but the business knows of and does not remedy a user\
\ interface that has that effect, the user interface may still be a dark\
\ pattern. Similarly, a business\u2019s deliberate ignorance of the effect\
\ of its user interface may also weigh in favor of establishing a dark pattern."
- urn: urn:intuitem:risk:req_node:ccpa_regulations:article-2
assessable: false
depth: 2
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:chapter-1
ref_id: ARTICLE 2
name: REQUIRED DISCLOSURES TO CONSUMERS
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7010
assessable: false
depth: 3
parent_urn: urn:intuitem:risk:req_node:ccpa_regulations:article-2
ref_id: '7010'
name: Overview of Required Disclosures.
- urn: urn:intuitem:risk:req_node:ccpa_regulations:7010-a