Page 73 - GDPR and US States General Privacy Laws Deskbook

73 | 
California Consumer Privacy Act of 2018 (as amended by the
California Privacy Rights Act of 2020) and Related Regulations
(d)  In lieu of posting the “Limit the Use of My Sensitive Personal Information” link, a business may provide the Alternative
Opt-out Link in accordance with section 7015. The business shall still post a Notice of Right to Limit in accordance with
these regulations.
(e)  A business that uses or discloses a consumer’s sensitive personal information for purposes other than those specified in
section 7027, subsection (m), shall provide the Notice of Right to Limit to consumers as follows:
(1)  A business shall post the Notice of Right to Limit on the internet webpage to which the consumer is directed after
clicking on the “Limit the Use of My Sensitive Personal Information” link. The notice shall include the information
specified in subsection (f) or be a link that takes the consumer directly to the specific section of the business’s privacy
policy that contains the same information. If clicking on the “Limit the Use of My Sensitive Personal Information” link
immediately effectuates the consumer’s right to limit, the business shall provide the notice within its privacy policy.
(2)  A business that does not operate a website shall establish, document, and comply with another method by which it
informs consumers of their right to limit. That method shall comply with the requirements set forth in section 7003.
(f) A business shall include the following in its Notice of Right to Limit:
(1) A description of the consumer’s right to limit; and
(2)  Instructions on how the consumer can submit a request to limit. If notice is provided online, the notice shall include
the interactive form by which the consumer can submit their request to limit online, as required by section 7027,
subsection (b)(1). If the business does not operate a website, the notice shall explain the offline method by which the
consumer can submit their request to limit.
(g)  A business does not need to provide a Notice of Right to Limit or the “Limit the Use of My Sensitive Personal Information”
link if:
(1)  It only uses and discloses sensitive personal information that it collected about the consumer for the purposes specified
in section 7027, subsection (m), and states so in its privacy policy; or
(2)  It only collects or processes sensitive personal information without the purpose of inferring characteristics about a
consumer, and states so in its privacy policy. (h) A business shall not use or disclose sensitive personal information it
collected during the time the business did not have a Notice of Right to Limit posted for purposes other than those
specified in section 7027, subsection (m), unless it obtains the consent of the consumer.
Note: Authority cited: Section 1798.185, Civil Code. Reference: Sections 1798.121, 1798.135 and 1798.185, Civil Code.
11 C.C.R. § 7015. Alternative Opt-out Link
(a)  The purpose of the Alternative Opt-out Link is to provide businesses the option of providing consumers with a single,
clearly-labeled link that allows consumers to easily exercise both their right to opt-out of sale/sharing and right to limit,
instead of posting the two separate “Do Not Sell or Share My Personal Information” and “Limit the Use of My Sensitive
Personal Information” links. The Alternative Opt-out Link shall direct the consumer to a webpage that informs them of
both their right to opt-out of sale/sharing and right to limit and provides them with the opportunity to exercise both rights.