California became the first U.S. state to enact a comprehensive consumer privacy law when it introduced the California Consumer Privacy Act in 2018 (CCPA), which California voters amended by passing the California Privacy Rights Act of 2020 (CPRA). The CPRA created the California Privacy Protection Agency (CPPA), a state government agency vested with administrative authority to implement and enforce the CCPA, as amended by the CPRA. The Agency’s final regulations to implement the CPRA amendments, which took effect Jan. 1, 2023, were approved with immediate effect on March 29, 2023.
On July 6, 2023, the CPPA rolled out its soft launch of a new online complaint system, which is currently active on the CPPA’s website. The new electronic complaint form gives consumers, afforded the protections of the CCPA, the ability to lodge both sworn and unsworn complaints alleging possible violations of California privacy laws. In addition to the consumer’s contact information, the online complaint system requires the consumer to answer seven questions. The first question requires the consumer to check boxes describing what the complaint is about, with the option to check multiple boxes. These options include the rights to delete, correct, limit or opt out of information-sharing practices, as well as options for violations such as businesses making it “unclear” as to how a consumer can submit a privacy request. The second question requires the consumer to fill out information about the business the consumer is alleging has violated the CCPA. The third option asks whether the consumer is a California citizen or not, but makes it clear that the consumer does not need to reside in California to submit a complaint. The fourth and fifth questions require the consumer to provide more information about the allegations and provides the option for attaching supporting documents, such as a screenshot of correspondence between the consumer and the allegedly infringing business. The sixth question asks whether the consumer has contacted the business about the possible violation of privacy rights, and the last question asks whether the complaint being lodged is sworn or unsworn.
The International Association of Privacy Professionals (IAPP) reported that CPPA Special Advisor Elizabeth Allen disclosed at the CPPA’s July 14, 2023 board meeting that the new online complaint system received 13 complaints since its soft-launch, that 54% of the complaints received were sworn, 54% of the complaints submitted were by California residents and the right to limit the use of sensitive personal information was the most frequently alleged violation of the CCPA. The CPPA intends to use the data it collects from these complaints to bring enforcement actions and to learn what rules and regulations of the CCPA are most commonly violated.
Now, in addition to filing a consumer complaint form against a business/company with the California Attorney General’s Office, consumers also have the option of filing a more streamlined complaint directly with the CPPA, the agency directly responsible for handling allegations of violation of the CCPA. The implementation of this new online system is further evidence of California’s continued commitment to giving consumers more control over their personal information gathered from them during interactions with commercial business, making compliance with CCPA and the CPPA’s recent rollout of the online complaint system an increasingly important concern for businesses.
