What do you need to know about the changes in the new, new, new, new, new CPRA Regs?
your good faith efforts to comply countdata minimization (reasonably necessary and proportionate) for the win, in almost any context Processing The processing of information has to be reasonably necessary and proportionate to achieve the purpose. Even if you get consent for a new/incompatible purpose, that use itself still needs to be reasonably necessary and proportionate to achieve the (new) purpose. This is similar to GDPR.In the context of dark patterns (deceptive design), the business’ intent to subvert or impair choice has been deleted as an official factor in assessing whether or not it qualifies. Opt-Out Requests You can only use information provided by the consumer in the context of an opt out request for that purpose only.You can give the consumer the option to provide information that identifies the consumer so that the request to opt-out of sale/sharing can apply to offline sale or sharing of personal information. However, if the consumer does not respond, you still need to process the opt-out preference signal as a valid request to opt-out of sale/sharing for that browser or device and any consumer profile the business associates with that browser or device, including pseudonymous profiles.Clarifying that opt out requests apply to any consumer profile the business associates with that browser or device. Right to Limit: The purposes which are the exceptions to the right to limit only apply for uses or disclosures which are