wyrick.com

The CCPA Regulations’ Accessibility Requirements: Do My Notices and Privacy Policy Comply?

As we discussed in our two-part series, Back to the Drawing Board? The Top Ten Impacts of the California AG’s Modified CCPA Regulations, the California Department of Justice recently released a modified version of the Department’s proposed CCPA regulations.  In the modified regulations, the Department overhauled some key provisions, adding yet another twist to the long and winding road leading to the CCPA’s July 1 enforcement date.

In this post, we assess the changes to the regulations’ requirement that notices and privacy policies be “reasonably accessible to consumers with disabilities.” 

For online notices and privacy policies, the modified regulations require notices and privacy policies that businesses provide to consumers under the CCPA to follow “generally recognized industry standards” for accessibility, “such as the Web Content Accessibility Guidelines, version 2.1 of June 5, 2018, from the World Wide Consortium.”   

The Guidelines are one of the most widely recognized standards for addressing the accessibility requirements of the Americans with Disabilities Act and have been cited in many cases, settlements, and consent decrees arising under that law. They address web content viewed on desktops, laptops, tablets, and mobile devices and provide recommendations to make online content more accessible to people with visual, auditory, physical, speech, cognitive, language, learning, and neurological disabilities. 

The Guidelines provide numerous recommendations to improve accessibility of various kinds of web content. Below, we examine the ones most relevant to notices and privacy policies required by the CCPA.

The Overarching Principles

The Guidelines outline four principles for web content accessibility. Under those principles, web content must be perceivable, operable, understandable, and robust. 

Perceivable: The Guidelines require that web content be presented to users in ways they can perceive. This includes:

  • Providing alternatives for any non-text content (e.g., preparing content that can be readily converted to text, braille, or speech using assistive technologies).
  • Creating web content that is adaptable (e.g., can be presented in different formats, such as a simpler layout, without altering the underlying information or structure).
  • Creating web content that is distinguishable (e.g., is easier for users to see through large-scale text or increased contrast ratios).

Operable: For web content to be accessible, the user must be able to operate user interfaces and navigation options. Operability is important to web page navigation perspective. To that end, the Guidelines suggest the following:

  • Make all website functionality operable from a keyboard.
  • Make it easy for users to operate the website through inputs beyond a keyboard.
  • Provide users with enough time to read and use the content (e.g., by removing or extending time limitations or automatic time out functions). 
  • Design web content in a way that will avoid causing seizures or other physical reactions (e.g., by avoiding flashes or motion animation and by using headings or labels to describe a topic and clearly organize content).

Understandable: Website users must be able to understand the information and how to operate the user interface. This means that the web content must be readable and “programmatically determinable.” For web content to “programmatically determinable,” it must be offered in a way that allows assistive technologies to understand the data and present it to users in different modalities, such as through synthesized speech or magnified content.

Assistive technologies include screen magnifiers or other visual reading assistants, screen readers, text-to-speech software, speech recognition software, alternative keyboards, and alternative pointing devices.

Robust:  Finally, web content must be robust enough that it can be interpreted by a wide variety of user agents (i.e., software that retrieves and presents web content to users) and assistive technologies.

The Good News

The good news for CCPA-covered businesses is that the Guidelines are straightforward and easy to comply with when it comes to text—the web content most commonly used to convey information in CCPA-required notices and privacy policies. 

Provided that you present your notices and privacy policy in the form of text on a webpage—instead of through graphics, video, audio, or images of text (such as a scanned PDF)—you’re probably already complying with the Guidelines from the standpoint of perceivability, understandability, and robustness.   

Addressing Operability

But it is still important not to overlook the principle of operability. Under that principle, you must still ensure that:

  • Users can navigate the webpages on which notices and privacy policies are posted from a keyboard or other inputs;
  • Users have enough time to read and understand the content (i.e., that your notice or privacy policy does not automatically time out or disappear); and
  • Notices and privacy policies are clearly labeled for easy navigation by the user.

Conclusion

The CCPA requires that notices and privacy policies be reasonably accessible to consumers with disabilities, and businesses need to be mindful that disabilities come in many forms: visual, auditory, physical, speech, cognitive, language, learning, and neurological. The Guidelines are a helpful tool to ensure that businesses are complying with the CCPA’s accessibility requirement across this wide range of disabilities.

CCPA-covered businesses should thus familiarize themselves with the Guidelines — whether or not they make it into the Attorney General’s final CCPA regulations — and evaluate how best to make their notices and policies more accessible to consumers with disabilities.