Cybersecurity Policy Report, Preliminary Comments Sought on Potential Changes to California Privacy Rules, (Apr 21, 2026)

By Tony Foley

The California Privacy Protection Agency (CalPrivacy) issued an invitation yesterday for preliminary comments regarding regulatory changes related to notices and disclosures under the California Consumer Privacy Act (CCPA) and the processing of employee data.

In its invitation for preliminary comments, CalPrivacy said it was exploring whether its existing regulations should be revised in these areas or if new regulations were required.

Notices and disclosures. The invitation asks consumers to outline what information about companies’ collection, use, disclosure, and retention of personal information they may want but currently cannot find. Additionally, the agency has asked for input on the following:

1. Language in privacy policies that is confusing, unclear, or difficult to understand;

2. Challenges businesses experience when describing information practices to consumers;

3. Effective ways for consumers to receive notice of their CCPA rights and how to exercise them;

4. Issues businesses confront when providing notices, including opt-out links, across different devices or platforms; and

5. Examples of effective consumer notices and disclosures, including, where possible, information about testing, studies, or data demonstrating their effectiveness.

Employee data. With respect to CCPA requirements regarding employees, including current and former employees and independent contractors, CalPrivacy asks the following questions:

1. What are the expectations or concerns regarding why a business collects, uses, discloses, or retains the personal information of a job applicant or employee;

2. Challenges businesses face when providing a privacy policy, notice at collection, or CCPA rights notice to job applicants or employees;

3. Whether individuals have exercised their rights as a job applicant or employee and a description of their experience;

4. Issues faced by businesses in providing job applicants and employees with the ability to exercise their CCPA rights; and

5. Steps businesses need to take to oversee service providers’ and contractors’ CCPA practices.

The preliminary comments are designed to assist CalPrivacy in preliminary rulemaking activities and do not reflect any decisions made regarding future rulemaking. If the agency decides to propose regulations, a formal public comment period will be held pursuant to the state’s Administrative Procedure Act. Comments will be accepted through May 20.

News: StateLegislation DataPrivacy CCPA