reglab/statecodes huggingface dataset:
California Code of Regulations › Title 11 - Law › Division 5 - Firearms Regulations › Chapter 41 - Unique Serial Number Applications › Article 3 - Engraving or Permanently Placing the Unique Serial Number and Uploading Digital Images of Firearms or Firearm Precursor Parts › Section 5519 - Special Requirements for Engraving or Permanently Placing the Unique Serial Number on a Firearm Made from Polymer Plastic

Current through Register 2024 Notice Reg. No. 28, July 12, 2024
A firearm manufactured or assembled from polymer plastic shall
					 contain its unique serial number on 3.7 ounces of material type 17-4 PH stainless
					 steel. This stainless steel piece shall be embedded within the plastic receiver or
					 frame upon the firearm's manufacture or assembly.
1. New section
					 filed 5-21-2018; operative 7-1-2018 (Register 2018, No. 21).
2. Amendment
					 of section heading and section filed 5-31-2023; operative 5-31-2023. Exempt from APA
					 pursuant to Statutes 2022, chapter 76 (AB 1621), section
					 39, and submitted to OAL for filing and
					 printing only pursuant to Government Code section
					 11343.8
					 (Register 2023, No. 22).
Note: Authority cited: Section
						29180, Penal Code.
						Reference: Section
						29180, Penal
						Code.
California Code of Regulations › Title 11 - Law › Division 5 - Firearms Regulations › Chapter 41 - Unique Serial Number Applications › Article 3 - Engraving or Permanently Placing the Unique Serial Number and Uploading Digital Images of Firearms or Firearm Precursor Parts › Section 5521 - Submitting Digital Images of the Newly Serialized Firearm or Firearm Precursor Part

Current through Register 2024 Notice Reg. No. 28, July 12, 2024
(a) Once the applicant
				  applies the unique serial number and additional information in a conspicuous
				  location on the firearm or firearm precursor part as required by section
				  5520, the applicant shall upload, onto
				  CFARS, a total of four clear digital images of the firearm or firearm precursor
				  part. These digital images shall clearly depict the firearm or firearm precursor
				  part and its newly engraved serial number. The four digital images shall be taken as
				  follows:
(1) One digital image shall be a close-up
				  image of the engraved, cast, stamped (impressed), or otherwise permanently placed
				  unique serial number and, for completed frames or receivers and functional firearms,
				  the additional information required by section
				  5520. This image shall encompass the
				  entire unique serial number, so the Department can easily read it when it reviews
				  this image.
(2) One digital image shall
				  depict the entire firearm or firearm precursor part. This image shall be
				  photographed horizontally and taken directly from above in a way that it captures
				  the entire firearm or firearm precursor part. The image shall encompass either of
				  the following:
(A) If it is a long gun the image
				  shall capture everything from the end of the barrel to the end of the stock;
				  or
(B) If it is a handgun the image
				  shall capture the handgun from the point furthest from the end of the barrel to the
				  opposite end of the handgun; or
(C) If
				  it is a firearm precursor part, receiver, or frame only, the entire firearm
				  precursor part, receiver, or frame shall be depicted.
(3) The other two digital images shall show the
				  left side of the firearm precursor part, receiver, or frame, and the right side of
				  the firearm precursor part, receiver, or frame. These locations are typically where
				  firearms are marked when manufacturing is complete.
California Code of Regulations › Title 11 - Law › Division 5 - Firearms Regulations › Chapter 41 - Unique Serial Number Applications › Article 4 - Modifying the Firearm During the 30 Day Period After the Department Issues the Unique Serial Number › Section 5522 - Modifying the Firearm During the 30 Day Period After the Department Issues the Unique Serial Number

Current through Register 2024 Notice Reg. No. 28, July 12, 2024
If the applicant wishes to make changes to the configuration of
					 the firearm while the applicant is manufacturing or assembling the firearm or wishes
					 to make changes to the description of the firearm that the applicant intended to
					 manufacture or assemble from a firearm precursor part, the applicant may do so as
					 long as all changes are made within the 30-day period following the date the
					 Department issued the unique serial number to the applicant. The applicant shall
					 record all changes made to the firearm or description of the intended firearm for a
					 firearm precursor part in the applicant's original unique serial number application
					 in CFARS. The digital images uploaded pursuant to section
					 5521 shall reflect the final version of
					 the firearm or firearm precursor part, including any changes that were made to it by
					 the applicant.
1. New article 8
					 (section 5522) and section filed 5-21-2018;
					 operative 7-1-2018 (Register 2018, No. 21).
2. Renumbering of former
					 article 8 to article 4 and amendment of section filed 5-31-2023; operative
					 5-31-2023. Exempt from APA pursuant to Statutes 2022, chapter 76 (AB 1621), section
					 39, and submitted to OAL for filing and
					 printing only pursuant to Government Code section
					 11343.8
					 (Register 2023, No. 22).
Note: Authority cited: Section
						29182, Penal Code.
						Reference: Sections: 29180 and 29182, Penal
						Code.
California Code of Regulations › Title 11 - Law › Division 6 - California Privacy Protection Agency › Chapter 1 - California Consumer Privacy Act Regulations › Article 1 - General Provisions › Section 7000 - Title and Scope

Current through Register 2024 Notice Reg. No. 28, July 12, 2024
(a) This
				  Chapter shall be known as the California Consumer Privacy Act Regulations. It may be
				  cited as such and will be referred to in this Chapter as "these regulations." These
				  regulations govern compliance with the California Consumer Privacy Act and do not
				  limit any other rights that consumers may have.
(b) A violation of these regulations shall
				  constitute a violation of the CCPA and be subject to the remedies provided for
				  therein.
1. New division 6
					 (section 7000 and Appendices A and B) and
					 section filed 1-4-2022; operative 2-3-2022 pursuant to Cal. Code Regs., title 2,
					 section 18750(l). Approved by
					 Fair Political Practices Commission 11-2-2021 and submitted to OAL for filing and
					 printing only pursuant to Cal. Code Regs., title 2, section
					 18750(k) (Register
					 2022, No. 1).
2. Change without regulatory effect renumbering section
					 7000 to section
					 7500, renumbering division 1, chapter
					 20 (articles 1-6, sections
					 999.300-999.337) to division 6, chapter
					 1 (articles 1-8, sections
					 7000-7081), adopting article 1 heading
					 and renumbering section
					 999.300 to new section
					 7000 filed 5-5-2022 pursuant to section
					 100, title 1, California Code of
					 Regulations (Register 2022, No. 18).
3. Amendment of NOTE filed
					 3-29-2023; operative 3-29-2023 pursuant to Government Code section
					 11343.4(b)(3)
					 (Register 2023, No. 13).
Note: Authority cited: Sections
						1798.175 and
						1798.185, Civil
						Code. Reference: Sections
						1798.100,
						1798.105,
						1798.106,
						1798.110,
						1798.115,
						1798.120,
						1798.121,
						1798.125,
						1798.130,
						1798.135,
						1798.140,
						1798.145,
						1798.150,
						1798.155,
						1798.175,
						1798.185,
						1798.199.40,
						1798.199.45,
						1798.199.50,
						1798.199.55 and
						1798.199.65, Civil
						Code.
California Code of Regulations › Title 11 - Law › Division 6 - California Privacy Protection Agency › Chapter 1 - California Consumer Privacy Act Regulations › Article 1 - General Provisions › Section 7002 - Restrictions on the Collection and Use of Personal Information

Current through Register 2024 Notice Reg. No. 28, July 12, 2024
(a) In accordance with Civil Code section
				  1798.100,
				  subdivision (c), a business's collection, use, retention, and/or sharing of a
				  consumer's personal information shall be reasonably necessary and proportionate to
				  achieve:
(1) The purpose(s) for which the personal
				  information was collected or processed, which shall comply with the requirements set
				  forth in subsection (b); or
(2) Another
				  disclosed purpose that is compatible with the context in which the personal
				  information was collected, which shall comply with the requirements set forth in
				  subsection (c).
California Code of Regulations › Title 11 - Law › Division 6 - California Privacy Protection Agency › Chapter 1 - California Consumer Privacy Act Regulations › Article 1 - General Provisions › Section 7003 - Requirements for Disclosures and Communications to Consumers

Current through Register 2024 Notice Reg. No. 28, July 12, 2024
(a) Disclosures and communications to consumers
				  shall be easy to read and understandable to consumers. For example, they shall use
				  plain, straightforward language and avoid technical or legal jargon.
(b) Disclosures required under Article 2 shall
				  also:
(1) Use a format that makes the disclosure
				  readable, including on smaller screens, if applicable.
(2) Be available in the languages in which the
				  business in its ordinary course provides contracts, disclaimers, sale announcements,
				  and other information to consumers in California.
(3) Be reasonably accessible to consumers with
				  disabilities. For notices provided online, the business shall follow generally
				  recognized industry standards, such as the Web Content Accessibility Guidelines,
				  version 2.1 of June 5, 2018, from the World Wide Web Consortium, incorporated herein
				  by reference. In other contexts, the business shall provide information on how a
				  consumer with a disability may access the policy in an alternative format.
California Code of Regulations › Title 11 - Law › Division 6 - California Privacy Protection Agency › Chapter 1 - California Consumer Privacy Act Regulations › Article 2 - Required Disclosures to Consumers › Section 7010 - Overview of Required Disclosures

Current through Register 2024 Notice Reg. No. 28, July 12, 2024
(a) Every
				  business that must comply with the CCPA and these regulations shall provide a
				  privacy policy in accordance with the CCPA and section
				  7011.
(b) A business that controls the collection of a
				  consumer's personal information from a consumer shall provide a Notice at Collection
				  in accordance with the CCPA and section
				  7012.
(c) Except as set forth in section
				  7025, subsection (g), a business that
				  sells or shares personal information shall provide a Notice of Right to Opt-out of
				  Sale/Sharing or the Alternative Opt-out Link in accordance with the CCPA and
				  sections 7013 and
				  7015.
(d) A business that uses or discloses a consumer's
				  sensitive personal information for purposes other than those specified in section
				  7027, subsection (m), shall provide a
				  Notice of Right to Limit or the Alternative Opt-out Link in accordance with the CCPA
				  and sections 7014 and
				  7015.
(e) A business that offers a financial incentive
				  or price or service difference shall provide a Notice of Financial Incentive in
				  accordance with the CCPA and section
				  7016.
1. Change without
					 regulatory effect adopting article 2 heading and renumbering section
					 999.304 to new section
					 7010, including amendments, filed
					 5-5-2022 pursuant to section
					 100, title 1, California Code of
					 Regulations (Register 2022, No. 18).
2. Amendment of article heading,
					 section heading, section and NOTE filed 3-29-2023; operative 3-29-2023 pursuant to
					 Government Code section
					 11343.4(b)(3)
					 (Register 2023, No. 13).
Note: Authority cited: Section
						1798.185, Civil
						Code. Reference: Sections
						1798.100,
						1798.105,
						1798.106,
						1798.110,
						1798.115,
						1798.120,
						1798.121,
						1798.125,
						1798.130 and
						1798.135, Civil
						Code.
California Code of Regulations › Title 11 - Law › Division 6 - California Privacy Protection Agency › Chapter 1 - California Consumer Privacy Act Regulations › Article 2 - Required Disclosures to Consumers › Section 7012 - Notice at Collection of Personal Information

Current through Register 2024 Notice Reg. No. 28, July 12, 2024
(a) The purpose of the Notice at Collection is to
				  provide consumers with timely notice, at or before the point of collection, about
				  the categories of personal information to be collected from them, the purposes for
				  which the personal information is collected or used, and whether that information is
				  sold or shared, so that consumers have a tool to exercise meaningful control over
				  the business's use of their personal information. For example, upon receiving the
				  Notice at Collection, the consumer can use the information in the notice as a tool
				  to choose whether to engage with the business, or to direct the business not to sell
				  or share their personal information and to limit the use and disclosure of their
				  sensitive personal information.
(b) The
				  Notice at Collection shall comply with section
				  7003, subsections (a) and
				  (b).
(c) The Notice at Collection shall
				  be made readily available where consumers will encounter it at or before the point
				  of collection of any personal information. Illustrative examples follow.
(1) When a business collects consumers' personal
				  information online, it may post a conspicuous link to the notice on the introductory
				  page of the business's website and on all webpages where personal information is
				  collected.
(2) When a business collects
				  consumers' personal information through a webform, it may post a conspicuous link to
				  the notice in close proximity to the fields in which the consumer inputs their
				  personal information, or in close proximity to the button by which the consumer
				  submits their personal information to the business.
(3) When a business collects personal information
				  through a mobile application, it may provide a link to the notice on the mobile
				  application's download page and within the application, such as through the
				  application's settings menu.
(4) When a
				  business collects consumers' personal information offline, it may include the notice
				  on printed forms that collect personal information, provide the consumer with a
				  paper version of the notice, or post prominent signage directing consumers to where
				  the notice can be found online.
(5) When
				  a business collects personal information over the telephone or in person, it may
				  provide the notice orally.
California Code of Regulations › Title 11 - Law › Division 6 - California Privacy Protection Agency › Chapter 1 - California Consumer Privacy Act Regulations › Article 2 - Required Disclosures to Consumers › Section 7014 - Notice of Right to Limit and the "Limit the Use of MY Sensitive Personal Information" Link

Current through Register 2024 Notice Reg. No. 28, July 12, 2024
(a) The purpose of
				  the Notice of Right to Limit is to inform consumers of their right to limit a
				  business's use and disclosure of their sensitive personal information and to provide
				  them with the opportunity to exercise that right. The purpose of the "Limit the Use
				  of My Sensitive Personal Information" link is to immediately effectuate the
				  consumer's right to limit, or in the alternative, direct the consumer to the Notice
				  of Right to Limit. Accordingly, clicking the business's "Limit the Use of My
				  Sensitive Personal Information" link will either have the immediate effect of
				  limiting the use and disclosure of the consumer's sensitive personal information or
				  lead the consumer to a webpage where the consumer can learn about and make that
				  choice.
(b) The Notice of Right to Limit
				  shall comply with section
				  7003, subsections (a) and
				  (b).
(c) The "Limit the Use of My
				  Sensitive Personal Information" link shall be a conspicuous link that complies with
				  section 7003, subsections (c) and (d), and is
				  located at either the header or footer of the business's internet
				  homepage(s).
(d) In lieu of posting the
				  "Limit the Use of My Sensitive Personal Information" link, a business may provide
				  the Alternative Opt-out Link in accordance with section
				  7015. The business shall still post a
				  Notice of Right to Limit in accordance with these regulations.
(e) A business that uses or discloses a consumer's
				  sensitive personal information for purposes other than those specified in section
				  7027, subsection (m), shall provide the
				  Notice of Right to Limit to consumers as follows:
(1) A business shall post the Notice of Right to
				  Limit on the internet webpage to which the consumer is directed after clicking on
				  the "Limit the Use of My Sensitive Personal Information" link. The notice shall
				  include the information specified in subsection (f) or be a link that takes the
				  consumer directly to the specific section of the business's privacy policy that
				  contains the same information. If clicking on the "Limit the Use of My Sensitive
				  Personal Information" link immediately effectuates the consumer's right to limit,
				  the business shall provide the notice within its privacy policy.
(2) A business that does not operate a website
				  shall establish, document, and comply with another method by which it informs
				  consumers of their right to limit. That method shall comply with the requirements
				  set forth in section
				  7003.
California Code of Regulations › Title 11 - Law › Division 6 - California Privacy Protection Agency › Chapter 1 - California Consumer Privacy Act Regulations › Article 2 - Required Disclosures to Consumers › Section 7015 - Alternative Opt-Out Link

Current through Register 2024 Notice Reg. No. 28, July 12, 2024
(a) The purpose
				  of the Alternative Opt-out Link is to provide businesses the option of providing
				  consumers with a single, clearly-labeled link that allows consumers to easily
				  exercise both their right to opt-out of sale/sharing and right to limit, instead of
				  posting the two separate "Do Not Sell or Share My Personal Information" and "Limit
				  the Use of My Sensitive Personal Information" links. The Alternative Opt-out Link
				  shall direct the consumer to a webpage that informs them of both their right to
				  opt-out of sale/sharing and right to limit and provides them with the opportunity to
				  exercise both rights.
(b) A business
				  that chooses to use an Alternative Opt-out Link shall title the link, "Your Privacy
				  Choices," or, "Your California Privacy Choices," and shall include the following
				  opt-out icon adjacent to the title. The link shall be a conspicuous link that
				  complies with section
				  7003, subsections (c) and (d), and is
				  located at either the header or footer of the business's internet homepage(s). The
				  icon shall be approximately the same size as other icons used by the business in the
				  header or footer of its webpage.
Click here
					 to view image
(c) The
				  Alternative Opt-out Link shall direct the consumer to a webpage that includes the
				  following information:
(1) A description of the
				  consumer's right to opt-out of sale/sharing and right to limit, which shall comply
				  with section 7003, subsections (a) and (b);
				  and
(2) The interactive form or
				  mechanism by which the consumer can submit their request to opt-out of sale/sharing
				  and their right to limit online. The method shall be easy for consumers to execute,
				  shall require minimal steps, and shall comply with section
				  7004.
California Code of Regulations › Title 11 - Law › Division 6 - California Privacy Protection Agency › Chapter 1 - California Consumer Privacy Act Regulations › Article 2 - Required Disclosures to Consumers › Section 7016 - Notice of Financial Incentive

Current through Register 2024 Notice Reg. No. 28, July 12, 2024
(a) The purpose of the Notice of Financial
				  Incentive is to explain to the consumer the material terms of a financial incentive
				  or price or service difference the business is offering so that the consumer may
				  make an informed decision about whether to participate. A business that does not
				  offer a financial incentive or price or service difference is not required to
				  provide a Notice of Financial Incentive.
(b) The Notice of Financial Incentive shall comply
				  with section 7003, subsections (a) and
				  (b).
(c) The Notice of Financial
				  Incentive shall be readily available where consumers will encounter it before
				  opting-in to the financial incentive or price or service difference. If the business
				  offers the financial incentive or price or service difference online, the notice may
				  be given by providing a link that takes the consumer directly to the specific
				  section of a business's privacy policy that contains the information required in
				  subsection (d).
(d) A business shall
				  include the following in its Notice of Financial Incentive:
(1) A succinct summary of the financial incentive
				  or price or service difference offered;
(2) A description of the material terms of the
				  financial incentive or price or service difference, including the categories of
				  personal information that are implicated by the financial incentive or price or
				  service difference and the value of the consumer's data;
(3) How the consumer can opt-in to the financial
				  incentive or price or service difference;
(4) A statement of the consumer's right to
				  withdraw from the financial incentive at any time and how the consumer may exercise
				  that right; and
(5) An explanation of
				  how the price or service difference is reasonably related to the value of the
				  consumer's data, including:
(A) A good-faith
				  estimate of the value of the consumer's data that forms the basis for offering the
				  price or service difference; and
(B) A
				  description of the method(s) the business used to calculate the value of the
				  consumer's data.
California Code of Regulations › Title 11 - Law › Division 6 - California Privacy Protection Agency › Chapter 1 - California Consumer Privacy Act Regulations › Article 3 - Business Practices for Handling Consumer Requests › Section 7020 - Methods for Submitting Requests to Delete, Requests to Correct, and Requests to Know

Current through Register 2024 Notice Reg. No. 28, July 12, 2024
(a) A business that
				  operates exclusively online and has a direct relationship with a consumer from whom
				  it collects personal information shall only be required to provide an email address
				  for submitting requests to delete, requests to correct, and requests to
				  know.
(b) A business that does not fit
				  the description in subsection (a) shall provide two or more designated methods for
				  submitting requests to delete, requests to correct, and requests to know. One of
				  those methods must be a toll-free telephone number. If the business maintains an
				  internet website, one of the methods for submitting these requests shall be through
				  its website, such as through a webform. Other methods for submitting requests to
				  delete, requests to correct, and requests to know may include, but are not limited
				  to, a designated email address, a form submitted in person, and a form submitted
				  through the mail.
(c) A business shall
				  consider the methods by which it primarily interacts with consumers when determining
				  which methods to provide for submitting requests to delete, requests to correct, and
				  requests to know. If the business interacts with consumers in person, the business
				  shall consider providing an in-person method such as a printed form the consumer can
				  directly submit or send by mail, a tablet or computer portal that allows the
				  consumer to complete and submit an online form, or a telephone with which the
				  consumer can call the business's toll-free number.
(d) A business may use a two-step process for
				  online requests to delete where the consumer must first, submit the request to
				  delete and then second, separately confirm that they want their personal information
				  deleted provided that the business otherwise complies with section
				  7004.
(e) If a consumer submits a request in a manner
				  that is not one of the designated methods of submission, or is deficient in some
				  manner unrelated to the verification process, the business shall either:
(1) Treat the request as if it had been submitted
				  in accordance with the business's designated manner, or
(2) Provide the consumer with information on how
				  to submit the request or remedy any deficiencies with the request, if
				  applicable.
California Code of Regulations › Title 11 - Law › Division 6 - California Privacy Protection Agency › Chapter 1 - California Consumer Privacy Act Regulations › Article 3 - Business Practices for Handling Consumer Requests › Section 7021 - Timelines for Responding to Requests to Delete, Requests to Correct, and Requests to Know

Current through Register 2024 Notice Reg. No. 28, July 12, 2024
(a) No later than 10
				  business days after receiving a request to delete, request to correct, or request to
				  know, a business shall confirm receipt of the request and provide information about
				  how the business will process the request. The information provided shall describe
				  in general the business's verification process and when the consumer should expect a
				  response, except in instances where the business has already granted or denied the
				  request. The confirmation may be given in the same manner in which the request was
				  received. For example, if the request is made over the phone, the confirmation may
				  be given orally during the phone call.
(b) Businesses shall respond to a request to
				  delete, request to correct, and request to know no later than 45 calendar days after
				  receipt of the request. The 45-day period will begin on the day that the business
				  receives the request, regardless of time required to verify the request. If the
				  business cannot verify the consumer within the 45-day time period, the business may
				  deny the request. If necessary, businesses may take up to an additional 45 calendar
				  days to respond to the consumer's request, for a maximum total of 90 calendar days
				  from the day the request is received, provided that the business provides the
				  consumer with notice and an explanation of the reason that the business will take
				  more than 45 days to respond to the request.
1. Change without
					 regulatory effect renumbering section
					 999.313, subsections (a)-(b) to new
					 section 7021, including amendment of section
					 heading and new NOTE, filed 5-5-2022 pursuant to section
					 100, title 1, California Code of
					 Regulations (Register 2022, No. 18).
2. Amendment of section heading,
					 section and NOTE filed 3-29-2023; operative 3-29-2023 pursuant to Government Code
					 section
					 11343.4(b)(3)
					 (Register 2023, No. 13).
Note: Authority cited: Section
						1798.185, Civil
						Code. Reference: Sections
						1798.100,
						1798.105,
						1798.106,
						1798.110,
						1798.115,
						1798.130,
						1798.140 and
						1798.185, Civil
						Code.
California Code of Regulations › Title 11 - Law › Division 6 - California Privacy Protection Agency › Chapter 1 - California Consumer Privacy Act Regulations › Article 3 - Business Practices for Handling Consumer Requests › Section 7022 - Requests to Delete

Current through Register 2024 Notice Reg. No. 28, July 12, 2024
(a) For
				  requests to delete, if a business cannot verify the identity of the requestor
				  pursuant to the regulations set forth in Article 5, the business may deny the
				  request to delete. The business shall inform the requestor that their identity
				  cannot be verified.
(b) A business shall
				  comply with a consumer's request to delete their personal information by:
(1) Permanently and completely erasing the
				  personal information from its existing systems except archived or backup systems,
				  deidentifying the personal information, or aggregating the consumer
				  information;
(2) Notifying the
				  business's service providers or contractors of the need to delete from their records
				  the consumer's personal information that they collected pursuant to their written
				  contract with the business, or if enabled to do so by the service provider or
				  contractor, the business shall delete the personal information that the service
				  provider or contractor collected pursuant to their written contract with the
				  business; and
(3) Notifying all third
				  parties to whom the business has sold or shared the personal information of the need
				  to delete the consumer's personal information unless this proves impossible or
				  involves disproportionate effort. If a business claims that notifying some or all
				  third parties would be impossible or would involve disproportionate effort, the
				  business shall provide the consumer a detailed explanation that includes enough
				  facts to give a consumer a meaningful understanding as to why the business cannot
				  notify all third parties. The business shall not simply state that notifying all
				  third parties is impossible or would require disproportionate effort.
California Code of Regulations › Title 11 - Law › Division 6 - California Privacy Protection Agency › Chapter 1 - California Consumer Privacy Act Regulations › Article 3 - Business Practices for Handling Consumer Requests › Section 7023 - Requests to Correct

Current through Register 2024 Notice Reg. No. 28, July 12, 2024
(a) For
				  requests to correct, if a business cannot verify the identity of the requestor
				  pursuant to the regulations set forth in Article 5, the business may deny the
				  request to correct. The business shall inform the requestor that their identity
				  cannot be verified.
(b) In determining
				  the accuracy of the personal information that is the subject of a consumer's request
				  to correct, the business shall consider the totality of the circumstances relating
				  to the contested personal information. A business may deny a consumer's request to
				  correct if it determines that the contested personal information is more likely than
				  not accurate based on the totality of the circumstances.
(1) Considering the totality of the circumstances
				  includes, but is not limited to, considering:
(A)
				  The nature of the personal information (
e.g.
, whether it is
				  objective, subjective, unstructured, sensitive, etc.).
(B) How the business obtained the contested
				  information.
(C) Documentation relating
				  to the accuracy of the information whether provided by the consumer, the business,
				  or another source. Requirements regarding documentation are set forth in subsection
				  (d).
California Code of Regulations › Title 11 - Law › Division 6 - California Privacy Protection Agency › Chapter 1 - California Consumer Privacy Act Regulations › Article 3 - Business Practices for Handling Consumer Requests › Section 7024 - Requests to Know

Current through Register 2024 Notice Reg. No. 28, July 12, 2024
(a) For requests
				  that seek the disclosure of specific pieces of information about the consumer, if a
				  business cannot verify the identity of the person making the request pursuant to the
				  regulations set forth in Article 5, the business shall not disclose any specific
				  pieces of personal information to the requestor and shall inform the requestor that
				  it cannot verify their identity. If the request is denied in whole or in part, the
				  business shall also evaluate the consumer's request as if it is seeking the
				  disclosure of categories of personal information about the consumer pursuant to
				  subsection (b).
(b) For requests that
				  seek the disclosure of categories of personal information about the consumer, if a
				  business cannot verify the identity of the person making the request pursuant to the
				  regulations set forth in Article 5, the business may deny the request to disclose
				  the categories and other information requested and shall inform the requestor that
				  it cannot verify their identity. If the request is denied in whole or in part, the
				  business shall provide or direct the consumer to its information practices set forth
				  in its privacy policy.
(c) In responding
				  to a request to know, a business is not required to search for personal information
				  if all of the following conditions are met:
(1)
				  The business does not maintain the personal information in a searchable or
				  reasonably accessible format.
(2) The
				  business maintains the personal information solely for legal or compliance
				  purposes.
(3) The business does not sell
				  the personal information and does not use it for any commercial purpose.
(4) The business describes to the consumer the
				  categories of records that may contain personal information that it did not search
				  because it meets the conditions stated above.
California Code of Regulations › Title 11 - Law › Division 6 - California Privacy Protection Agency › Chapter 1 - California Consumer Privacy Act Regulations › Article 3 - Business Practices for Handling Consumer Requests › Section 7025 - Opt-Out Preference Signals

Current through Register 2024 Notice Reg. No. 28, July 12, 2024
(a) The purpose
				  of an opt-out preference signal is to provide consumers with a simple and
				  easy-to-use method by which consumers interacting with businesses online can
				  automatically exercise their right to opt-out of sale/sharing. Through an opt-out
				  preference signal, a consumer can opt-out of sale and sharing of their personal
				  information with all businesses they interact with online without having to make
				  individualized requests with each business.
(b) A business that sells or shares personal
				  information shall process any opt-out preference signal that meets the following
				  requirements as a valid request to opt-out of sale/sharing:
(1) The signal shall be in a format commonly used
				  and recognized by businesses. An example would be an HTTP header field or JavaScript
				  object.
(2) The platform, technology, or
				  mechanism that sends the opt-out preference signal shall make clear to the consumer,
				  whether in its configuration or in disclosures to the public, that the use of the
				  signal is meant to have the effect of opting the consumer out of the sale and
				  sharing of their personal information. The configuration or disclosure does not need
				  to be tailored only to California or to refer to California.
California Code of Regulations › Title 11 - Law › Division 6 - California Privacy Protection Agency › Chapter 1 - California Consumer Privacy Act Regulations › Article 3 - Business Practices for Handling Consumer Requests › Section 7026 - Requests to Opt-Out of Sale/Sharing

Current through Register 2024 Notice Reg. No. 28, July 12, 2024
(a) A
				  business that sells or shares personal information shall provide two or more
				  designated methods for submitting requests to opt-out of sale/sharing. A business
				  shall consider the methods by which it interacts with consumers, the manner in which
				  the business collects the personal information that it makes available to third
				  parties, available technology, and ease of use by the consumer when determining
				  which methods consumers may use to submit requests to opt-out of sale/sharing. At
				  least one method offered shall reflect the manner in which the business primarily
				  interacts with the consumer. Illustrative examples follow.
(1) A business that collects personal information
				  from consumers online shall, at a minimum, allow consumers to submit requests to
				  opt-out of sale/sharing through an opt-out preference signal and at least one of the
				  following methods: an interactive form accessible via the "Do Not Sell or Share My
				  Personal Information" link, the Alternative Opt-out Link, or the business's privacy
				  policy if the business processes an opt-out preference signal in a frictionless
				  manner.
(2) A business that interacts
				  with consumers in person and online may provide an in-person method for submitting
				  requests to opt-out of sale/sharing in addition to the opt-out preference
				  signal.
(3) Other methods for submitting
				  requests to opt-out of the sale/sharing include, but are not limited to, a toll-free
				  phone number, a designated email address, a form submitted in person, and a form
				  submitted through the mail.
(4) A
				  notification or tool regarding cookies, such as a cookie banner or cookie controls,
				  is not by itself an acceptable method for submitting requests to opt-out of
				  sale/sharing because cookies concern the collection of personal information and not
				  the sale or sharing of personal information. An acceptable method for submitting
				  requests to opt-out of sale/sharing must address the sale and sharing of personal
				  information.
California Code of Regulations › Title 11 - Law › Division 6 - California Privacy Protection Agency › Chapter 1 - California Consumer Privacy Act Regulations › Article 3 - Business Practices for Handling Consumer Requests › Section 7027 - Requests to Limit Use and Disclosure of Sensitive Personal Information

Current through Register 2024 Notice Reg. No. 28, July 12, 2024
(a) The unauthorized use or disclosure of
				  sensitive personal information creates a heightened risk of harm for the consumer.
				  The purpose of the request to limit is to give consumers meaningful control over how
				  their sensitive personal information is collected, used, and disclosed. It gives the
				  consumer the ability to limit the business's use of sensitive personal information
				  to that which is necessary to perform the services or provide the goods reasonably
				  expected by an average consumer who requests those goods or services, with some
				  narrowly tailored exceptions, which are set forth in subsection (m). Sensitive
				  personal information that is collected or processed without the purpose of inferring
				  characteristics about a consumer is not subject to requests to limit.
(b) A business that uses or discloses sensitive
				  personal information for purposes other than those set forth in subsection (m) shall
				  provide two or more designated methods for submitting requests to limit. A business
				  shall consider the methods by which it interacts with consumers, the manner in which
				  the business collects the sensitive personal information that it uses for purposes
				  other than those set forth in subsection (m), available technology, and ease of use
				  by the consumer when determining which methods consumers may use to submit requests
				  to limit. At least one method offered shall reflect the manner in which the business
				  primarily interacts with the consumer. Illustrative examples follow.
(1) A business that collects sensitive personal
				  information from consumers online shall, at a minimum, allow consumers to submit
				  requests to limit through an interactive form accessible via the "Limit the Use of
				  My Sensitive Personal Information" link or the Alternative Opt-out Link.
(2) A business that interacts with consumers in
				  person and online may provide an in-person method for submitting requests to limit
				  in addition to the online form.
(3)
				  Other methods for submitting requests to limit include, but are not limited to, a
				  toll-free phone number, a designated email address, a form submitted in person, and
				  a form submitted through the mail.
(4) A
				  notification or tool regarding cookies, such as a cookie banner or cookie controls,
				  is not by itself an acceptable method for submitting requests to limit because
				  cookies concern the collection of personal information and not necessarily the use
				  and disclosure of sensitive personal information. An acceptable method for
				  submitting requests to limit must address the specific right to limit.
California Code of Regulations › Title 11 - Law › Division 6 - California Privacy Protection Agency › Chapter 1 - California Consumer Privacy Act Regulations › Article 3 - Business Practices for Handling Consumer Requests › Section 7028 - Requests to Opt-in After Opting-Out of the Sale or Sharing of Personal Information

Current through Register 2024 Notice Reg. No. 28, July 12, 2024
(a) Requests to opt-in
				  to sale or sharing of personal information shall use a two-step opt-in process
				  whereby the consumer shall first, clearly request to opt-in and then second,
				  separately confirm their choice to opt-in.
(b) If a consumer who has opted-out of the sale or
				  sharing of their personal information initiates a transaction or attempts to use a
				  product or service that requires the sale or sharing of their personal information,
				  the business may inform the consumer that the transaction, product, or service
				  requires the sale or sharing of their personal information and provide instructions
				  on how the consumer can provide consent to opt-in to the sale or sharing of their
				  personal information. The business shall comply with section
				  7004 when obtaining the consumer's
				  consent.
1. Change without
					 regulatory effect renumbering section
					 999.316 to new section
					 7028 filed 5-5-2022 pursuant to section
					 100, title 1, California Code of
					 Regulations (Register 2022, No. 18).
2. Amendment of section heading and
					 section filed 3-29-2023; operative 3-29-2023 pursuant to Government Code section
					 11343.4(b)(3)
					 (Register 2023, No. 13).
Note: Authority cited: Section
						1798.185, Civil
						Code. Reference: Sections
						1798.120,
						1798.135 and
						1798.185, Civil
						Code.
California Code of Regulations › Title 11 - Law › Division 6 - California Privacy Protection Agency › Chapter 1 - California Consumer Privacy Act Regulations › Article 3 - Business Practices for Handling Consumer Requests › Section 7031 - Requests to Know or Delete Household Information. [Repealed]

Current through Register 2024 Notice Reg. No. 28, July 12, 2024
1. Change without
					 regulatory effect renumbering section
					 999.318 to new section
					 7031, including amendments, filed
					 5-5-2022 pursuant to section
					 100, title 1, California Code of
					 Regulations (Register 2022, No. 18).
2. Repealer filed 3-29-2023;
					 operative 3-29-2023 pursuant to Government Code section
					 11343.4(b)(3)
					 (Register 2023, No. 13).
Note: Authority cited: Section
						1798.185, Civil
						Code. Reference: Sections
						1798.100,
						1798.105,
						1798.110,
						1798.115,
						1798.120,
						1798.130,
						1798.140 and
						1798.185, Civil
						Code.
California Code of Regulations › Title 11 - Law › Division 6 - California Privacy Protection Agency › Chapter 1 - California Consumer Privacy Act Regulations › Article 4 - Service Providers, Contractors, and Third Parties › Section 7050 - Service Providers and Contractors

Current through Register 2024 Notice Reg. No. 28, July 12, 2024
(a) A
				  service provider or contractor shall not retain, use, or disclose personal
				  information collected pursuant to its written contract with the business except:
(1) For the specific business purpose(s) set forth
				  in the written contract between the business and the service provider or contractor
				  that is required by the CCPA and these regulations.
(2) To retain and employ another service provider
				  or contractor as a subcontractor, where the subcontractor meets the requirements for
				  a service provider or contractor under the CCPA and these regulations.
(3) For internal use by the service provider or
				  contractor to build or improve the quality of the services it is providing to the
				  business, even if this business purpose is not specified in the written contract
				  required by the CCPA and these regulations, provided that the service provider or
				  contractor does not use the personal information to perform services on behalf of
				  another person. Illustrative examples follow.
(A)
				  An email marketing service provider can send emails on a business's behalf using the
				  business's customer email list. The service provider could analyze those customers'
				  interactions with the marketing emails to improve its services and offer those
				  improved services to everyone. But the service provider cannot use the original
				  email list to send marketing emails on behalf of another business.
(B) A shipping service provider that delivers
				  businesses' products to their customers may use the addresses received from their
				  business clients and their experience delivering to those addresses to identify
				  faulty or incomplete addresses, and thus, improve their delivery services. However,
				  the shipping service provider cannot compile the addresses received from one
				  business to send advertisements on behalf of another business, or compile addresses
				  received from businesses to sell to data brokers.
(4) To prevent, detect, or investigate data
				  security incidents or protect against malicious, deceptive, fraudulent or illegal
				  activity, even if this business purpose is not specified in the written contract
				  required by the CCPA and these regulations.
(5) For the purposes enumerated in Civil Code
				  section
				  1798.145,
				  subdivisions (a)(1) through (a)(7).
California Code of Regulations › Title 11 - Law › Division 6 - California Privacy Protection Agency › Chapter 1 - California Consumer Privacy Act Regulations › Article 4 - Service Providers, Contractors, and Third Parties › Section 7052 - Third Parties

Current through Register 2024 Notice Reg. No. 28, July 12, 2024
(a) A third
				  party that does not have a contract that complies with section
				  7053, subsection (a), shall not
				  collect, use, process, retain, sell, or share the personal information that the
				  business made available to it.
(b) A
				  third party shall comply with the terms of the contract required by the CCPA and
				  these regulations, which include treating the personal information that the business
				  made available to it in a manner consistent with the business's obligations under
				  the CCPA and these regulations.
1. New section
					 filed 3-29-2023; operative 3-29-2023 pursuant to Government Code section
					 11343.4(b)(3)
					 (Register 2023, No. 13).
Note: Authority cited: Section
						1798.185, Civil
						Code. Reference: Sections
						1798.100,
						1798.105,
						1798.106,
						1798.110,
						1798.115,
						1798.120,
						1798.121,
						1798.130,
						1798.135,
						1798.140 and
						1798.185, Civil
						Code.