1. (a) Except as expressly allowed by the CCPA and these regulations, businesses shall design and implement methods for submitting CCPA requests and obtaining consumer consent that incorporate the following principles:

   1. (1) Easy to understand. The methods shall use language that is easy for consumers to read and understand. When applicable, they shall comply with the requirements for disclosures to consumers set forth in section 7003.

   2. (2) Symmetry in choice. The path for a consumer to exercise a more privacy-protective option shall not be longer or more difficult or time-consuming than the path to exercise a less privacy-protective option because that would impair or interfere with the consumer's ability to make a choice. Illustrative examples and requirements follow.

      1. (A) It is not symmetrical when a business's process for submitting a request to opt-out of sale/sharing requires more steps than that business's process for opting-in to the sale of personal information. For example, the number of steps for submitting a request to opt-out of sale/sharing as measured from when the consumer clicks on the “Do Not Sell or Share My Personal Information” link to completion of the request should be the same or fewer than the number of steps for submitting a request to opt-in to the sale of personal information where the business offers a link for consumers to learn more about opting-in to the business's sale or sharing of their personal information.
      2. (B) A choice to opt-in to the sale of personal information that provides only the two options, “Yes” and “Ask me later,” is not equal or symmetrical because there is no option to decline the opt-in. “Ask me later” implies that the consumer has not declined but delayed the decision and that the business will continue to ask the consumer to opt-in. Framing the consumer's options in this manner impairs the consumer's ability to make a choice. An equal or symmetrical choice could be between “Yes” and “No.”
      3. (C) A website banner that provides only the two options, “Accept All” and “More Information,” or, “Accept All” and “Preferences,” when seeking the consumer's consent to use their personal information is not equal or symmetrical because the method allows the consumer to “Accept All” in one step, but requires the consumer to take additional steps to exercise their rights over their personal information. Framing the consumer's options in this manner impairs the consumer's ability to make a choice. An equal or symmetrical choice could be between “Accept All” and “Decline All.”
      4. (D) A choice where the “yes” button is more prominent (e.g., larger in size or in a more eye-catching color) than the “no” button is not equal or symmetrical.
      5. (E) A choice where the option to participate in a financial incentive program is selected by default or featured more prominently (e.g., larger in size or in a more eye-catching color) than the choice not to participate in the program is neither equal nor symmetrical.

   3. (3) Do not use language or interactive elements that are confusing to the consumer. The methods must not use double negatives, misleading statements or omissions, affirmative misstatements, or deceptive language. Toggles or buttons must clearly indicate the consumer's choice. A consumer's silence or failure to act affirmatively does not constitute consent. Illustrative examples of prohibited methods follow.

      1. (A) Giving the choice of “Yes” or “No” next to the statement “Do Not Sell or Share My Personal Information” is a double negative and a confusing choice for a consumer.
      2. (B) Toggles or buttons that state “on” or “off” are confusing to a consumer if they do not include further clarifying language.
      3. (C) The unintuitive placement of buttons to confirm a consumer's choice is confusing to the consumer. For example, it is confusing to the consumer when a business at first consistently offers choices in the order of “Yes,” then “No,” but then offers choices in the opposite order--“No,” then “Yes”--when asking the consumer something that would contravene the consumer's expectation.
      4. (D) A consumer closing or navigating away from a pop-up window on a website that requests consent without first affirmatively selecting the equivalent of an “I accept” button shall not constitute consent. Such a method for obtaining consent is confusing to the consumer.
      5. (E) Choices driven by a false sense of urgency are misleading. A countdown clock displayed next to a consent choice which states “time is running out to consent to this data use and receive a limited discount” where the discount is not actually limited by time or availability is misleading.

   4. (4) Do not use choice architecture that impairs or interferes with the consumer's ability to make a choice. Businesses must not design their methods in a manner that would impair the consumer's ability to exercise their choice because consent must be freely given, specific, informed, and unambiguous. Illustrative examples and requirements follow.

      1. (A) Requiring the consumer to click through disruptive screens before they are able to submit a request to opt-out of sale/sharing is a choice architecture that impairs or interferes with the consumer's ability to exercise their choice.
      2. (B) Bundling choices so that the consumer is only offered the option to consent to using personal information for purposes that meet the requirements set forth in section 7002, subsection (a), together with purposes that are incompatible with the context in which the personal information was collected is a choice architecture that impairs or interferes with the consumer's ability to make a choice. For example, a business that provides a location-based service, such as a mobile application that finds gas prices near the consumer's location, shall not require the consumer to consent to incompatible uses (e.g., sale of the consumer's geolocation to data brokers) together with a reasonably necessary and proportionate use of geolocation information for providing the location-based services, which does not require consent. This type of choice architecture does not allow consent to be freely given, specific, informed, or unambiguous because it requires the consumer to consent to incompatible uses in order to obtain the expected service. The business must provide the consumer a separate option to consent to the business's use of personal information that does not meet the requirements set forth in section 7002, subsection (a).
      3. (C) Acceptance of general or broad terms of use, or a similar document, that contains descriptions of personal information processing along with other, unrelated information. This type of choice architecture prevents consent from being freely given, specific, and informed, or from signifying agreement for a narrowly defined particular purpose.

   5. (5) Easy to execute. The business shall not add unnecessary burden or friction to the process by which the consumer submits a CCPA request or provides or withdraws consent. Methods must be tested to ensure that they are functional and do not undermine the consumer's choice to submit the request. Illustrative examples and requirements follow.

      1. (A) Upon clicking the “Do Not Sell or Share My Personal Information” link, the business shall not require the consumer to search or scroll through the text of a privacy policy or similar document or webpage to locate the mechanism for submitting a request to opt-out of sale/sharing.
      2. (B) A business that knows of, but does not remedy, circular or broken links, or nonfunctional email addresses, such as inboxes that are not monitored or have aggressive filters that screen emails from the public, may be in violation of this regulation.
      3. (C) Businesses that require the consumer to unnecessarily wait on a webpage as the business processes the request or require consumers to fill out multiple or duplicative forms or impose unnecessary waiting periods between form submissions may be in violation of this regulation.
      4. (D) Businesses that require the consumer to call a toll-free telephone number to submit a CCPA request must ensure that the individuals handling those phone calls have the knowledge and ability to process the consumer's CCPA requests.
2. (b) A method that does not comply with subsection (a) may be a dark pattern. The illustrative examples provided in subsection (a) constitute a non-exhaustive list of dark patterns. Any agreement obtained through the use of dark patterns shall not constitute consumer consent. For example, a business that uses dark patterns to obtain consent from a consumer to sell their personal information shall be in the position of never having obtained the consumer's consent to do so.
3. (c) A user interface is a dark pattern if the interface has the effect of substantially subverting or impairing user autonomy, decisionmaking, or choice. A business's intent in designing the interface is not determinative in whether the user interface is a dark pattern, but a factor to be considered. If a business did not intend to design the user interface to subvert or impair user choice, but the business knows of and does not remedy a user interface that has that effect, the user interface is still a dark pattern.

Note: Authority cited: Section 1798.185, Civil Code. Reference: Sections 1798.100, 1798.105, 1798.106, 1798.110, 1798.115, 1798.120, 1798.121, 1798.125, 1798.130, 1798.135, 1798.140 and 1798.185, Civil Code.

History

1. New section filed 3-29-2023; operative 3-29-2023 pursuant to Government Code section 11343.4(b)(3) (Register 2023, No. 13).

2. Amendment filed 9-22-2025; operative 1-1-2026 (Register 2025, No. 39).