CCPA amendments have been officially signed into law. On Friday, October 11, California Governor Gavin Newsom signed all 5 amendments passed by the California legislature into law. The passage of the amendments comes on the heels of Attorney General Xavier Becerra issuing his much-anticipated guidance around the CCPA. These recent developments have been critical in solidifying the final text of the CCPA, just two and half months before the law takes effect.

Interested in learning more about the AG’s proposed regulations? Sign up for our webinar on Tuesday, October 15, 2019 at 10:00 a.m. (PST) | 1:00 p.m. (ET) or on Thursday, October 17, 2019 at 10:00 a.m. (ET) | 15:00 (BST)

For more information, including the full text of each amendment signed into law, visit our CCPA Amendment tracker.

Highlights of the Bills Passed

AB-25 –  Exemption of employee from definition of consumer (One of the most eagerly awaited amendments)

Excludes until January 1, 2021 personal information about job applicants, employees, contractors from the scope of the CCPA. The emergency contact information of the job applicants, employees, contractors are also excluded from CCPA scope. BUT there are two important exceptions: Businesses must still provide privacy notice and the direct right of action (in case of untreated breach) is still available to them

AB-1355 – Clean-up & addressing differential treatment and disclosures

Fixes cross-referencing errors

Under the non-discrimination provision, allows differential treatment of a consumer who has exercised CCPA rights if the differential treatment is reasonably related to value provided to the business by the consumer’s information

Requires businesses to disclose in their privacy policy consumer’s right to request specific pieces of information and the categories of information collected by businesses

AB-874 – Carve outs from the ‘personal information’

Redefines “publicly available information”

Clarifies that personal information does not include de-identified or aggregated consumer information

AB-1146 – Exemption for vehicle information

Exempts vehicle information shared between a new auto dealer and a vehicle manufacturer when information is shared or retained pursuant to, or in anticipation of, a vehicle repair relating to warranty work or recall.

AB-1564 – Consumer requests

Requires businesses to make available a toll-free number and at least one additional method for submitting consumer requests.

Businesses that have a website are also required to provide a web form or portal for submitting consumer requests.

If a business operates exclusively online, it can only provide an email address and (if it has a website) the web portal/form for submitting consumer requests.

Amended rules on consumer identity verification in response to their request. Allows business to require authentication of the consumer “that is reasonable in light of the nature of the personal information requested”. Consumer should not be required to create an account for verification, but if the consumer already has an existing account, the business can require the consumer to submit his CCPA request through it

Other California Bills Related to Privacy Signed by Governor Newsome

AB-1202 – Data broker requirements

Defines a “data broker” and requires data brokers to register with and provide certain information to the Attorney General, and failure to register may lead to liability (civil penalties, fees and costs)

Regardless of where you are with your privacy program, it is never too early to start planning for your CCPA readiness. OneTrust for CCPA is a full set of scalable solutions and services specifically designed to implement CCPA requirements and workflows to support a global privacy program.

For additional information, or to request a live OneTrust for CCPA software demo, visit or email [email protected].


Check out our CCPA blog series: