.

Client Alert

California Attorney General Issues Draft Regulations for CCPA

October 16, 2019

by Joseph Lynyak and Erin Bryan

Download as a PDF

Share this page

1. Introduction

On October 11, 2019, the California Attorney General (the “California AG”) issued draft regulations (the “Draft Regulations”) pursuant to his authority under the California Consumer Privacy Act of 2018 (“CCPA”).1 The publication of the Draft Regulations commences the public comment period during which numerous interpretative issues relating to the implementation of the CCPA hopefully will be addressed and resolved.

Unfortunately, the California AG chose to limit the Draft Regulations to basic process issues relating to the overall structure of the CCPA, and elected not to address many of the more difficult compliance problems identified by industry participants. More troubling is the inclusion of additional procedural steps that a covered “business”2 must follow when complying with “requests” for “personal information”3 (“PI”). (If ultimately adopted, several of these additional compliance obligations could likely create technical and unintended violations of the CCPA.)4

This Alert provides an initial analysis of the approach taken by the Draft Regulations, as well as suggestions for participating in the rule-making process.5

2. Discussion

Analysis of the Draft Regulations

The Draft Regulations were issued by the California AG pursuant to authority delegated to him by Section 1798.185 of the CCPA. Notwithstanding the fact that the Draft Regulations are proposals and not yet final, the Draft Regulations establish a “backbone” based upon which covered businesses may begin to evaluate whether their implementation and compliance programs appear reasonable.

The Draft Regulations are comprised of seven “Articles”; Articles 1 and 7 contain definitions and a severability clause, whereas Articles 2 through 6 are the implementing provisions of the CCPA, and address:

  • The notification process by covered business to California “consumers” of their rights under the CCPA6
  • The processing of “verifiable consumer requests”7
  • The verification of identify for consumer requests8
  • Special rules for minors’ PI,9 and
  • Determining value to comply with the anti-discrimination provisions of the CCPA

Articles 2 through 6 of the Draft Regulations will be addressed separately below.

A. General

In numerous provisions scattered across Articles 2 through 6, the Draft Regulations establish varying degrees of care that must be exercised by a business when dealing with a consumer, including identifying the consumer, evaluating the sensitivity of a consumer’s request, and responding in a manner that protects a request for data or to delete PI.10

In addition, borrowing from federal consumer law that consumer disclosures be “clear and conspicuous,” among other things required notices must be easily understood, formatted, and accessible to consumers, and provided in the languages in which a business interacts with consumers.11

From a drafting perspective, the Draft Regulations intentionally conflate non-internet-based business operations with partial or sole internet contact between businesses and consumers by interrelating and cross-referencing CCPA obligations. This approach (which may be necessary for brevity’s sake yet nevertheless complicated) will require businesses to carefully parse through the Draft Regulations’ compliance mandates in order to identify various subcategories of business models that might apply and may require differing compliance obligations.

B. The Notification Process of a Consumer’s Rights

Article 2 sets forth several disclosures that have to be prepared and provided by a business to a consumer. It is by far the most instructive of the five Articles, and indicates the content that must be included in disclosures provided to consumers.

Article 2 of the Draft Regulations sets forth general principles when providing a disclosures of how a business collects PI, and indicates that a notice must contain the following information:

  • A list of the categories of PI about consumers to be collected,
  • For each category of PI, the business or commercial purpose(s) for which it will be used,
  • If the business sells PI, the link titled “Do Not Sell My Personal Information” or “Do Not Sell My Info,” and
  • A link to the business’s privacy policy.12

Article 2 imposes an expanded disclosure requirement when describing categories of PI, including a requirement that a business explain the business or commercial purpose for which PI will be collected. Further, a specific prohibition states that if a business intends to expand the scope of PI being collected, it must first provide a new disclosure to the consumer (which confirms that a new disclosure process must be undertaken by a business).13
 
Article 2 addresses several subcategories of notices that must be provided. For example, Article 2 addresses the notice that has to be provided regarding the right of a consumer to “opt-out” of the sale of PI (assuming an exception does not apply).14 Depending upon the nature of the contact between the business and the consumer, a notice of a consumer’s opt-out right must include the following:

  • A description of the consumer’s right to opt-out of the sale of their PI,
  • The web-based form by which the consumer can submit their request to opt-out online (or, if the business does not operate a website, the offline method by which the consumer can submit their request to opt-out),
  • Instructions for any other method by which the consumer may submit their request to opt-out,
  • Any proof required when a consumer uses an authorized agent to exercise their right to opt-out, and
  • A link or the URL to the business’s privacy policy (or, in the case of a printed form containing the notice, the URL of the webpage where consumers can access the privacy policy).15

Another subcategory of notice and disclosure is a notice of financial incentives that describes the incentive being offered, the material terms of the financial incentives and the right of the consumer to withdraw at any time.

Finally, Section 999.308(b) the Draft Regulations requires a detailed and expanded description of a businesses’ privacy policy. The privacy policy must be posted on a business’s website (or posted in a conspicuous place if the business dose not operate a website), and must include:

  • The right to know about the collection, disclosure and sale of PI,
  • The right to request deletion of PI,
  • The right to opt-out of the sale of PI,
  • The right to non-discrimination for the exercise of a consumer’s CCPA rights,
  • The use of an authorized agent,
  • A contact for additional information,
  • The date the business’ privacy policy was last updated, and
  • If Section 999.317(g) of the Draft Regulations applies, the metrics required or a link to it.16

C. The Processing of Verified Consumer Requests by Covered Business

Article 3 of the Draft Regulations contains a somewhat complicated set of requirements that vary depending upon the mode of conducting business between a business and a consumer.

As an initial matter, the Draft Regulations indicate that a business must provide two or more methods for submitting requests to know about PI, which must include a toll-free telephone number, along with several other acceptable methods that may be employed. However, while a request to delete PI must include two permissible methods of making the request, a toll-free number (while permissible) is not mandatory.17 Importantly, any method for making a request must “reflect the manner in which the business primarily interacts with a consumer.”18 If a consumer makes a request that is not a designated methodology selected by the business, the business may choose to treat the request as having been made through a proper channel, or else must contact the consumer and provide specific directions to submit a request properly.19

Following the receipt of a request to know or a request to delete, the Draft Regulations add a new procedural step that is not included in the statutory language of the CCPA—which is a requirement within 10 days of the receipt of a request the business must notify the consumer that the request has been received and how the request will be processed. (It appears that this new 10-day notice falls within the CCPA statutory deadline of 45 days to respond and up to a maximum of 90 days20.)21

The Draft Regulations contain detailed instructions for responding to requests to know and request to delete—the emphasis is placed on verification of the identification of the consumer. If verification is not possible, a business may decline to respond to the request, but must notify the consumer that the denial was based upon the failure to properly identify the consumer. In the instance in which the consumer has a password-protected account with a business, the business may provide a secure portal for retrieving the requested data.

In regard to a request to opt-out, a business must provide two alternative methods to submit a request to opt-out, including a mandatory interactive web-based form using a link entitled “Do Not Sell My Personal Information,” or “Do Not Sell My Info” on the business’s website or mobile application.22 (Other alternative methods include a toll-free number, a designated email address, a form submitted in person, or an electronic mechanism to indicated the consumer’s choice to opt-out.) A business may offer a consumer the option to opt-out of sale of certain categories of PI, provided that the opt-out of the sale of all information is more prominently displayed. A request to opt-out must be acted upon within 15 days of the business’s receipt of the request.23

Record retention for compliance is set at 24 months (although retention of requests may by necessity be longer if an exemption is asserted, such as the retention of PI based upon the length of an applicable statute of limitations or threat of litigation being brought against a business for non-compliance).

D. Verification Alternatives for Properly identifying a Consumer

Article 4 of the Draft Regulations create a sliding scale of consumer verification standards based upon the sensitivity of PI being requested. Factors include:

  • The type, sensitivity, and value of the PI collected and maintained about the consumer (i.e., sensitive or valuable PI requires more stringent verification processes),
  • The risk of harm to the consumer posed by any unauthorized access or deletion,
  • The likelihood that fraudulent or non-authorized individuals are seeking the PI,
  • Whether the PI is sufficiently robust to protect against fraudulent requests or being spoofed or fabricated,
  • The manner in which the business interacts with the consumer, and
  • The availability of technology for verification.

In the case of a customer that holds a password-protected account with a business, the business may require the customer to verify the customer’s identity through the account. However, if a request is made, the business must also require that the customer reverify the customer’s identification before disclosing or deleting PI.24

The Draft Regulations establish a sliding scale of verification steps depending upon whether a request is made for categories of PI or specific items of PI. In the case in which a consumer has a password-protected account with a business, the business may employ its existing verification procedures when responding to a consumer’s request. In the case of a request to identify categories of PI when a consumer either does not have a password-protected account or no account with a business, the a business must identify a consumer with a “reasonable degree of certainty”—which is defined to mean matching a consumer with at least two data points of identification. In the case a consumer either does not have a password-protected account or no account with a business and specific items of PI are requested, the standard for verification is a “reasonably high degree of certainty”—which is defined to mean at least three pieces of PI provided by the consumer plus a verification signed by the consumer under penalty of perjury.25

Article 4 also identifies several steps that a business should undertake to verify a consumer’s identity, based upon the factual matter whether the consumer has an account with the business. This combination of qualitative and quantitative factors may require individual attention to a consumer’s request, and in any event may present challenges for developing automated response applications.26

In the case of a request to delete PI, the Draft Regulations would require that the standard and verification methodology would vary depending upon the sensitivity of the PI and the risk of harm to the consumer.

Finally, when a consumer employs an agent to make a request, the business may require that the authorization be made in writing and that the consumer verify his/her identity directly with the business.

E. Protection of Minors and Their PI

Article 4 of the Draft Regulations is relatively straightforward in regard to a business obtaining the consent of a parent of a child for the child’s PI below the age of 13, but requires that the parent (or guardian) adequately verify the status of the parent or guardian. Verification alternatives include:

  • Providing a consent form to be signed by the parent or guardian under penalty of perjury and returned to the business by postal mail, facsimile, or electronic scan,
  • Requiring a parent or guardian, in connection with a monetary transaction, to use a credit card, debit card, or other online payment system that provides notification of each discrete transaction to the primary account holder,
  • Having a parent or guardian call a toll-free telephone number staffed by trained personnel,
  • Having a parent or guardian connect to trained personnel via video-conference,
  • Having a parent or guardian communicate in person with trained personnel, and
  • Verifying a parent or guardian’s identity by checking a form of government-issued identification against databases of such information.27

Unfortunately, Article 5 is silent in regard to any process by which a business might reasonably identify that a minor is communicating with the business. Whether the business can rely upon parental oversight of a minor’s use of the internet is not addressed.28

F. Complying with the anti-discrimination provisions of the CCPA

Section 1798.125 of the CCPA prohibits a business from discriminating against a consumer because the consumer exercised a privacy right conferred by the CCPA, such as by opting-out from the sale of PI. However, a business may offer a price or service differential for not exercising CCPA rights if it is reasonably related to the value of the consumer’s PI.

Article 6 of the Draft Regulations requires that, when setting a price differential, a business must use one of the following valuation methodologies:

  • The marginal value to the business of the sale, collection, or deletion of a consumer’s data or a typical consumer’s data,
  • The average value to the business of the sale, collection, or deletion of a consumer’s data or a typical consumer’s data,
  • Revenue or profit generated by the business from separate tiers, categories, or classes of consumers or typical consumers whose data provides differing value,
  • Revenue generated by the business from sale, collection, or retention of consumers’ PI,
  • Expenses related to the sale, collection, or retention of consumers’ PI,
  • Expenses related to the offer, provision, or imposition of any financial incentive or price or service difference,
  • Profit generated by the business from sale, collection, or retention of consumers’ PI, or
  • Any other practical and reliable method of calculation used in good-faith.29

The quantification and justification of a value may prove to be problematic to businesses when used to support differing pricing between consumers exercising or not exercising CCPA rights. For example, in the case of a business that employs voluminous data sets, revenue generated by individual consumers may be difficult to correlate a pricing differential that is more than nominal. Further, whether supportive economic evidence is necessary may present a cost factor that smaller businesses may find unrealistic.

Providing Input During the Public Comment Period

When issuing the Draft Regulations for public comment, the California AG announced that his office would be holding hearings December 2nd in Sacramento, December 3 in LA, December 4th in San Francisco and on December 5th in Fresno. Comments on the Draft Regulations can be provided at those hearings, via mail or via e-mail.

Observations

The Draft Regulations add new obligations and varying qualitative standards for compliance that  may present practical compliance difficulties to covered businesses. Although the process and disclosure clarifications provide a clearer roadmap when preparing a project plan for compliance, efforts will have to be undertaken to ensure that a business’s policies and procedures include the numerous compliance obligations set forth in the Draft Regulations analyzed herein.

While as noted above the Draft Regulations attempt to provide a compliance structure for CCPA notices and processing of requests from consumers, the primarily failure of the Draft Regulations is the failure to address reliable interpretations of unresolved issues set forth in the CCPA, such as the various exemptions contained in the CCPA. This may mean that businesses seeking to make use of exemptions or partial exemptions will be forced to submit focused interpretative requests to the California AG. (Whether the California AG will be responsive to requests for interpretations remains to be seen.)

The proposed inclusion of non-statutory response times and qualitative standards discussed herein are particularly problematic and could be the subject of a challenge by industry stakeholders that may determine that compliance with these additional requirements is unrealistic and beyond the delegated authority of the California AG.  Additionally, industry stakeholders are likely to raise concerns about the proposed requirement that businesses treat user-enabled anti-tracking privacy controls as equivalent to a verifiable opt-out request.

Finally, as is frequently the case, completely new regulatory schemes that are initially finalized and issued are rarely modified until their effectiveness is evaluated—which in the case of the Draft Regulations may mean extended period of time. We strongly recommend that businesses consider submitting comment letters to the California AG—either directly or through intermediaries. (Of course, attorneys at Dorsey are available to assist in this task.)

*       *       *

Please note that this Alert is an initial analysis of the issues and concerns raised by the Draft Regulations, but is not intended to constitute a comprehensive identification of concerns that businesses will face in their compliance efforts. It is likely that covered businesses will identify other significant compliance issues, and those concerns should be addressed wither through the comment or interpretative administrative processes.

We are available to discuss any questions or comments.

1 Section 1798.100 et seq. of the California Civil Code.
2 Section 1798.140(c) of the CCPA.
3 Section 1798(o) of the CCPA.
4 As stated in the Draft Regulations, a violation of the Draft Regulations will be deemed a violation of the statutory requirements of the CCPA. See, Section 999.300(b) of the Draft Regulations (available at: https://oag.ca.gov/privacy/ccpa).
5 https://oag.ca.gov/privacy/ccpa.
6 Section 1798.140(g) defines a “consumer” as a California resident. (Note, however, that AB 25, which was signed by the California Governor, for a 1-year period temporarily exempts most employee-related data from coverage under the CCPA.
7 Section 1798.140(y) of the CCPA.
8 Section 1798.185(a)(7) of the CCPA.
9 Section 1798.120(c) of the CCPA.
10 The Draft Regulations generally use the defined terms a “request to know” and a “request to delete” to mean a communication from a consumer relating to PI and the exercise of the consumer’s privacy rights. See, Sections 999.301(n) and (o) of the Draft Regulations.
11 Disclosures must be readily available with individuals with disabilities, which in the internet world has created significant litigation risk for non-compliance. See, Section 999.305(d) of the Draft Regulations.
12 Section 999.305(b) of the Draft Regulations.
13 Section 999.305(a)(4) of the Draft Regulations.
14 Unfortunately, the Draft Regulations completely ignore how the exercise and disclosure of the various exceptions contain in the CCPA should be handled.
15 Section 999.306(c) of the Draft Regulations.
16 It should be noted that these categories contain numerous items of required disclosure; a business preparing its privacy policy should ensure that it has included all required items.
17 A request to delete must entail a two-step process: first, a request to delete PI, and second, a separate confirmation that deletion of PI has been requested.
18 Section 999.312(c) of the Draft Regulations.
19 Section 999.312(f) of the Draft Regulations. (For large businesses, this latter requirement could present considerable training challenges.)
20 Section 999.313(a) of the Draft Regulations. Compare with, Section 1798.130(a)(2) of the CCPA.
21 This shortening of the response time may be particularly burdensome to large businesses that elect to centralize their CCPA responses.
22 The Draft Regulations are notably silent when differentiating between internet websites and mobile applications; compliance with both alternative communication modes could present technology challenges to businesses if more than a link to a website is required in the case of a mobile application.
23 Section 999.315(e) of the Draft Regulations.  In a clear change from the statutory requirements of the CCPA, Section 999.315(h) indicates that a request to opt-out need not meet the standard of a verified consumer request, which may complicate compliance and training policies and procedures.
24 Section 999.324(a) of the Draft Regulations.
25 Sections 999.324 and 999.325 of the Draft Regulations.
26 Sections 999.323, 999.324 and 999.325 of the Draft Regulations.
27 "(b) When a business receives an affirmative authorization pursuant to subsection (a) of this section, the business shall inform the parent or guardian of the right to opt-out at a later date and of the process for doing so on behalf of their child pursuant to section 999.315.” Section 999.330 of the Draft Regulations.
28 Article V of the Draft Regulations. This likely means that the default language is that contained in the CCPA, which imposes special opt-in requirements for minors when a business has “actual knowledge that a consumer is less than 16 years of age.”
29 Section 999.337(b) of the Draft Regulations.

 

Firm Highlights

Attorney John Cooney Returns to Dorsey in the Finance & Restructuring Group in Minneapolis

News

Attorney John Cooney Returns to Dorsey in the Finance & Restructuring Group in Minneapolis

Insights

The Supreme Court Update - October 8, 2026

On September 29, 2026, the Supreme Court granted certiorari in one case: Department of Homeland Security v. D.V.D., No. 26-426: This case concerns the Trump Administration’s “third-country removal” procedures, where immigrants are deported to countries not listed in the removal orders. In granting certiorari, the Court granted the Government’s application to stay a lower court decision halting the practice, which will allow third-country removals to continue pending resolution of the case. The issues presented are: (1) Whether the district court had jurisdiction over respondents’ claims; (2) whether the district court had authority to enter class-wide declaratory relief and APA vacatur under 8 U.S.C. § 1252(f)(1); (3) whether the Government’s guidance on third-country removals is unlawful under 8 U.S.C. § 1231(b), the due process clause, or FARRA/CAT and its implementing regulations; and (4) such other questions that the Government determines are appropriate for the proper disposition of the case. On October 1, 2026, the Court granted certiorari in three additional cases: Rhoney v. Barbosa da Cunha, No. 26-104: Immigration officials detained Ricardo Aparecido Barbosa da Cunha—a Brazilian citizen who had lived in the United States for approximately twenty years after entering without inspection—and denied him a bond hearing under 8 U.S.C. § 1225(b)(2)(A). The Second Circuit held that his detention was instead governed by § 1226(a), which permits release on bond, because § 1225(b)(2)(A)’s mandatory-detention requirement applies only to noncitizens apprehended while entering the country or shortly thereafter. The question presented is: Whether 8 U.S.C. § 1225(b)(2)(A) mandates the detention pending removal proceedings of aliens who, like Barbosa da Cunha, are present in the United States without having been admitted. Missionaries of St. John the Baptist, Inc. v. Frederic, No. 25-113: A Catholic religious organization sought to build a shrine to the Virgin Mary on land the organization owned adjacent to its church in Park Hills, Kentucky. Local zoning restrictions prohibited the proposed construction. The question presented is: Whether a land-use regulation that prohibits a religious institution from building a religious structure on its own property constitutes a “substantial burden” on religious exercise under the Substantial Burden Provision of the Religious Land Use and Institutionalized Persons Act, 42 U.S.C. § 2000cc(a). Marschner v. Marschner, No. 25-1349: Under the Uniformed Services Former Spouses’ Protection Act (“USFSPA”), a veteran’s longevity-based retirement pay can be divided in a divorce, but retirement pay based on disability and retirement pay that was waived to receive disability pay are indivisible. The question presented is: Does the USFSPA require state courts to refuse enforcement of indemnification provisions in a divorce settlement agreement?

Insights

EPA Limits Title V Re-Litigation of NSR Permits

Overview On September 25, 2026, the U.S. Environmental Protection Agency (“EPA”) published a final rule that significantly limits the ability of third parties to use the Clean Air Act (“CAA”) Title V permitting process to revisit New Source Review (“NSR”) permitting decisions years after those decisions were made. The rule establishes that NSR permitting determinations generally must be challenged during the original permitting proceeding, thereby providing regulated sources with greater permitting certainty and finality for major capital projects. Published in the Federal Register titled Clarifying the Scope of “Applicable Requirements” Under State Operating Permit Programs and the Federal Operating Permit Program (Docket ID No. EPA-HQ-OAR-2023-0401), the rule amends 40 C.F.R. Parts 70 and 71 to codify EPA’s interpretation regarding when requirements established under other CAA programs may be reviewed, modified, or implemented through the Title V operating permit program. The rule becomes effective 30 days after publication. The rule addresses two principal issues: (1) the relationship between NSR preconstruction permitting and Title V operating permits, and (2) the treatment of the General Duty Clause under CAA section 112(r)(1). Most significantly, the rule provides greater certainty for sources navigating the NSR permitting process. EPA’s amendments are intended to ensure that NSR permitting decisions made through an approved public process are generally not revisited later through Title V permit proceedings. The rule responds to a circuit split between the U.S. Courts of Appeals for the Fifth and Tenth Circuits. In Environmental Integrity Project v. EPA, 969 F.3d 529 (5th Cir. 2020), the Fifth Circuit upheld EPA’s interpretation, concluding that it was consistent with the text, structure, and purpose of Title V. In contrast, the Tenth Circuit reached the opposite conclusion in Sierra Club v. EPA, 964 F.3d 882 (10th Cir. 2020), finding that the then-existing regulatory definition of “applicable requirement” did not support EPA’s position. By amending the regulatory language on which the Tenth Circuit relied and codifying the interpretation approved by the Fifth Circuit, EPA has established a nationwide framework governing the interaction between NSR and Title V. NSR and Title V: EPA Establishes a Uniform Nationwide Framework At the core of the rule is EPA’s effort to define the respective roles of NSR and Title V. The rule codifies the approach EPA has applied since 2017: once a source obtains an NSR permit under an EPA-approved permitting program, and that permit was issued following public notice with an opportunity for comment and judicial review, the permit establishes the NSR-related “applicable requirements” of the State Implementation Plan (“SIP”) or Federal Implementation Plan (“FIP”) for Title V purposes. Under this framework, Title V is not a vehicle for re-examining underlying NSR permitting decisions. EPA does not intend to use the Title V process to revisit applicability determinations, emissions calculations, control technology determinations, permit conditions, or other issues resolved through the NSR permitting process. This principle applies regardless of the stage of the Title V proceeding; whether the NSR permit was issued pursuant to a SIP or FIP; the type of NSR issue involved; or whether the NSR permit is incorporated into Title V sequentially or concurrently. Limited Exceptions EPA recognizes several circumstances in which NSR issues may still be reviewed through the Title V program: No NSR permit was issued at all; The permit was issued without public notice and an opportunity for comment and judicial review; or The issue involves substantive overlap between Title V and NSR requirements, such as the adequacy of monitoring provisions. As a result, the rule does not insulate unpermitted projects or foreclose review of matters that independently arise under Title V. Key Regulatory Amendments The rule revises the definition of “applicable requirement” in 40 C.F.R. §§ 70.2 and 71.2. Paragraph (1): Where an NSR permit is issued with public notice and an opportunity for comment and judicial review, the permit establishes and defines the applicable SIP or FIP requirements for Title V purposes. Paragraph (2): All NSR permit terms, including terms contained in minor NSR permits, constitute applicable requirements that must be incorporated into Title V permits. Paragraph (4): CAA section 112(r)(1) (the General Duty Clause) is expressly excluded from the definition of “applicable requirement,” while section 112(r)(7) Risk Management Program requirements remain included. EPA also amended 40 C.F.R. §§ 70.8 and 70.12 to clarify that alleged defects in requirements established outside the Title V process generally do not provide a basis for EPA objection to a Title V permit or for a Title V citizen petition. General Duty Clause Exclusion The rule also codifies EPA’s longstanding position that the General Duty Clause in CAA section 112(r)(1) is not an “applicable requirement” for Title V purposes. EPA points to several considerations supporting that conclusion, including the distinction between the General Duty Clause and Title V permit terms, the provision’s origins in the Occupational Safety and Health Act’s general duty clause, and the different enforcement structures applicable to the General Duty Clause and Title V permit requirements. Importantly, excluding section 112(r)(1) from the definition of “applicable requirement” does not eliminate EPA’s authority to enforce the General Duty Clause independently of the Title V program. The final rule instead clarifies that the General Duty Clause need not—and should not—be incorporated into Title V permits as an applicable requirement. Practical Implications for Regulated Sources Greater Finality for NSR Permits  For projects requiring PSD, nonattainment NSR, or minor NSR permits, the permitting process becomes the primary forum for resolving disputes regarding applicability determinations, emissions calculations, control technology requirements, offsets, and permit conditions. Once an NSR permit is issued through a qualifying public process, regulated sources should face substantially reduced risk that those same issues will be challenged years later through Title V permit proceedings. Reduced Risk of Collateral Permit Challenges Stakeholders have sometimes sought to use Title V permit issuance, renewal, revision, or citizen-petition proceedings to challenge underlying NSR determinations. The final rule makes clear that Title V is not the appropriate vehicle for challenging whether an applicable requirement was correctly established in the first instance. This should reduce the risk of permit delays and uncertainty associated with collateral challenges to previously issued NSR permits. The rule does not, however, eliminate all Title V challenges relating to an NSR permit. Challenges concerning the Title V permit itself—including whether it appropriately incorporates applicable requirements or contains adequate compliance provisions—remain possible. Increased Importance of the Initial NSR Proceeding Because Title V generally will not provide a second opportunity to challenge the substantive validity of an NSR determination, the administrative record developed during the NSR process becomes increasingly important. Permit applicants should ensure that applicability analyses, emissions calculations, control technology evaluations, modeling demonstrations, and supporting technical documentation are thoroughly developed during the original permitting proceeding. For significant projects, applicants may therefore have an additional incentive to identify and resolve potential permitting issues before the NSR permit is issued rather than assuming that unresolved issues can be addressed during a subsequent Title V proceeding. Potential Incentive for Broader Public Participation EPA also notes that permitting authorities may choose to provide public notice and an opportunity for comment for a broader range of NSR permits because permits issued through a qualifying public process receive the benefit of the finality framework established by the rule. Some permitting authorities may conclude that greater public participation at the NSR stage is preferable to uncertainty during subsequent Title V proceedings. Conclusion The final rule is principally a permitting-certainty measure. For sources that obtain NSR permits through a public process, EPA has substantially limited the ability of third parties to revisit underlying NSR determinations through the Title V program. As a result, regulated entities should benefit from greater finality regarding key permitting decisions, reduced risk of collateral permit challenges, and increased certainty when planning and implementing capital projects.

The image shows classic stone columns and steps, which often represent government buildings, courthouses, or legal institutions.

Insights

The Supreme Court Update - October 14, 2026

News

Dorsey Recognized in Inaugural 2026 IAM/WTR Copyright 1000

Dorsey & Whitney LLP is pleased to announce its recognition in the inaugural edition of the Copyright 1000: The World’s Leading Copyright Professionals, published by IAM and World Trademark Review (WTR). Nine Dorsey attorneys were individually recognized, and the Firm’s Denver, Minneapolis, New York, Salt Lake City, and Seattle offices were recognized in the firm rankings. The following Dorsey attorneys were recognized in the inaugural guide: Lindsey Sadler Gregory Tamkin Charlene Krogh Evan Everist Jeffrey Cadwell Fara Sunderji Bruce Ewing Catherine Parrish Lake J. Michael Keyes The Copyright 1000 is the first dedicated ranking focused solely on the world’s leading copyright practitioners. The guide identifies leading copyright firms and practitioners across key jurisdictions worldwide. Dorsey’s intellectual property attorneys advise clients on a wide range of copyright matters, including protection, enforcement, licensing, litigation, transactions, and issues involving emerging technologies and digital content. The inaugural Copyright 1000 rankings are published by IAM and WTR.

Regulatory Affairs Partner Jeff Beelaert Joins Dorsey in Boise

News

Regulatory Affairs Partner Jeff Beelaert Joins Dorsey in Boise

Dorsey Recognized in Chambers UK 2027

News

Dorsey’s London Corporate Practice and Partners Earn Chambers UK 2027 Rankings

Insights

SEC Proposes Expansion of Investment Adviser Performance-Based Compensation Rule

On September 30, 2026, the Securities and Exchange Commission (the “SEC”) proposed amendments to Rule 205-3 under the Investment Advisers Act of 1940, as amended (the “Advisers Act”), which provides an exemption from the general prohibition under Section 205(a)(1) of the Advisers Act on registered investment advisers receiving performance-based compensation (the “Proposal”) so long as performance-based compensation is limited to “qualified clients”.1 Most notably for private fund sponsors, the Proposal would expand the definition of “qualified client” to include any investors that satisfy the “accredited investor” definition under Regulation D. The Proposal may also have implications for private fund managers that rely on exemptions from investment adviser registration under state law because certain state-level investment adviser registration exemptions incorporate or otherwise reference the federal qualified client definition. Expansion of the Qualified Client Definition Under the current Rule 205-3, an investor generally may qualify as a qualified client if, among other alternatives, the investor has at least $1.4 million under management with the adviser or has a net worth exceeding $2.7 million. These thresholds are higher than the financial thresholds applicable to many accredited investors under Regulation D. As a result, an investor may currently qualify as an accredited investor for purposes of investing in a private offering without qualifying as a qualified client for purposes of paying performance-based compensation. The Proposal would expand the qualified client definition to include any natural person or legal entity investor that satisfies the accredited investor definition under Regulation D. The Proposal would also remove the assets under management and net worth thresholds under the current Rule 205-3 qualified client test. For private funds relying on Section 3(c)(1) of the Investment Company Act of 1940, this change could reduce the need to apply a separate qualified client standard to investors that already qualify as accredited investors. Dorsey Observations and Next Steps If adopted as proposed, the expanded qualified client definition could be particularly significant for private fund managers. Most private fund offerings are already limited to accredited investors under Regulation D. However, the Proposal could expand the pool of prospective investors available to emerging private fund managers while reducing the regulatory burden associated with complying with Rule 205-3. The Proposal could also benefit advisers operating below the SEC registration threshold that rely on a state private fund adviser exemption. A number of states have adopted exemptions modeled on the North American Securities Administrators Association (“NASAA”) private fund adviser exemption, which may condition relief for advisers to certain funds relying on Section 3(c)(1) on each beneficial owner satisfying the federal qualified client definition. However, state requirements vary, and any effect of the Proposal would depend on the text of the applicable state exemption and how it incorporates Rule 205-3. Many emerging private fund managers may have a larger network of accredited investor relationships than qualified client relationships during the early stages of their investment advisory business. Currently, under Rule 205-3, private fund managers may receive performance-based compensation from investors who do not satisfy the qualified client definition if those investors were admitted to their private funds prior to registration with the SEC. Following registration with the SEC, however, managers may continue to permit investors that are not qualified clients to invest in future private funds but may not receive performance-based compensation from those investors with respect to such investments. In addition, because the net worth and assets under management thresholds for qualified client status are adjusted for inflation every five years, the pool of qualified client investors may diminish over time as previously eligible investors no longer satisfy the applicable thresholds. The Proposal could provide the dual benefit of greater flexibility for private fund managers to establish and maintain relationships with accredited investors as their businesses scale and they become registered with the SEC, and greater flexibility for certain accredited investors to participate in investment strategies that historically have been restricted to much larger institutional investors. Unless and until the Proposal is adopted, investment advisers should continue to comply with the existing qualified client requirements. If the Proposal is adopted, private fund sponsors should consider whether corresponding changes are appropriate for their subscription documents, investor questionnaires, and other offering materials. Advisers that are state-registered or rely on a state-level exemption should also consult the laws and regulations of each relevant jurisdiction before changing investor eligibility standards or performance-based compensation practices, because adoption of the federal amendments may not automatically modify state requirements. Comments on the Proposal will be due 60 days after publication in the Federal Register. 1 Investment Adviser Performance-Based Compensation Modernization, Investment Advisers Act Release No. IA-7022 (Sept. 30, 2026), available at https://www.sec.gov/rules-regulations/2026/09/s7-2026-28#33-11443proposed.

Insights

Energy Law: Month in Review - September 2026

Welcome to Dorsey’s Energy Law: Month in Review. We provide this update to our clients to identify significant developments in the previous month. Please reach out to any of the authors, listed above, to discuss these issues. Regulatory Developments Massachusetts Ratchets Up State and Local Regulation of AI Data Centers In early September, Governor Maura Healey of Massachusetts signed an executive order requiring that artificial intelligence data centers secure the approval of local communities as a precondition to proceeding with a given project. According to the terms of the order, data center developers will need to secure a “community benefits agreement” as a precondition to receiving permits from numerous state agencies, including the Department of Environmental Protection, the Energy Facilities Siting Board, and the Massachusetts Environmental Policy Act Office. Beyond requiring community benefits agreements, the order also mandates that developers mitigate utility costs to consumers, prohibits the use of nondisclosure agreements, and requires various state agencies to develop measures to limit data center impacts on the environment. North Carolina Regulators Decline Approval of Duke Energy Gas Turbine On September 18, 2026, North Carolina Utilities Commission (NCUC) denied Duke Energy’s application for a certificate of public convenience and necessity required to construct a gas-fueled combustion turbine at its Smith Energy Complex in North Carolina. The NCUC objected strongly to the $584 million price tag and noted that Duke appeared to be constructing the facility “based on anticipated data center customer additions.” The NCUC rejected that anticipated growth as “insufficiently reliable for the Commission to act at this point.” In rejecting Duke’s application, the NCUC also noted that Duke had signed the White House Ratepayer Protection Pledge, in which it represented that it would not shift data center costs to consumers. The NCUC observed that the record did not demonstrate how Duke “intends to adhere to its commitments under the Ratepayer Protection Pledge with regard to the Proposed Facility.” Notably, commission staff had actually supported the construction of the turbine, citing concerns about Duke’s reserve margins. The NCUC noted that it “understands the Public Staff’s expressed concerns,” but those concerns were outweighed by the NCUC’s reservations, including questions of demand. Department of Energy Approves Funds for Grid Improvement The U.S. Department of Energy (DOE) recently announced that it would fund 31 grid-improvement projects in 26 states. The funding initiative is part of the DOE’s “SPARK” initiative. The funding will include $1.9 billion in federal funding from DOE and $3.35 billion in recipient cost-sharing funding. The funds will go to projects designed to improve grid reliability and lower electricity costs. Recipients plan to reconductor over 1,500 miles of transmission lines and will deploy grid-enhancing technologies across approximately 21,000 miles. DOE stated that this initiative will make available over 23 additional gigawatts of electricity. Texas Moderates Rules Governing Data Center Interconnection The Texas Public Utility Commission adopted new regulations governing large-load interconnections. The rules impose a flat study fee of $100,000 for all proposed interconnections, which departs from the initial proposal to impose study fees using a tiered system based on project size. Additionally, the final rule eliminates the PUC’s previous proposal to impose a non-refundable interconnection fee of $50,000 per MW of contracted peak demand. The final rule also moderates the initially proposed regulations governing Electric Reliability Council of Texas (ERCOT) notifications for large-load customers’ non-utilized capacity. The proposed rules would have required notifying ERCOT within 30 days of missing a scheduled energization milestone by six months. The final rules, however, do not require informing ERCOT unless a scheduled energization milestone is missed by 24 months. FERC Denies TransAlta 202(c) Cost-Recovery Plan The Federal Energy Regulatory Commission (FERC) recently rejected TransAlta’s plan to recover $19.9 million in expenses stemming from a DOE order in which DOE prohibited TransAlta from retiring its coal-powered Centralia power plant. TransAlta had previously intended to retire the facility at the end of 2025. TransAlta’s cost recovery plan proposed spending an additional $23 million on repairs to continue operating the unit. FERC’s main objection had to do with geographic scope. TransAlta’s recovery plan called for recovering costs from California Independent System Operator (CAISO) and the Southwest Power Pool (SPP), but the DOE’s order requiring operation of the plant was designed to ensure reliability in the Northwest assessment area (Montana, Oregon, Washington, and parts of northern California and northern Idaho). Accordingly, FERC was unwilling to allow cost recovery from CAISO and SPP when the order that precipitated the additional costs only related to the Northwest assessment area. FERC informed TransAlta that it would only approve cost recovery from load-serving entities in the Northwest assessment area. FERC’s decision comes amid a rush of DOE emergency orders requiring the continued operation of coal-fired generating units. Litigation Appeals Court Upholds Washington Hydropower Plant With Caveats In a September 21, 2026, opinion, the Washington Court of Appeals largely upheld a Clean Water Act water quality certification by the Washington Department of Ecology for the Goldendale Energy Storage Project, a proposed pumped-water storage hydropower system adjacent to, but off-stream from, the Columbia River. A nonprofit (Columbia Riverkeeper) and the Confederated Tribes and Bands of the Yakama Nation appealed the certification, contending that it failed to impose necessary conditions and monitoring requirements to protect the water quality of the Columbia River. Most saliently, the plaintiffs argued that the project had the potential to leak 100 acre-feet of water per year into tributaries of the Columbia River. The Court of Appeals broadly rejected plaintiffs’ challenge to the state’s conclusion that “the project was designed not to leak.” That said, the Court of Appeals did reverse on one narrow issue. Specifically, the court determined that the state’s conclusion that “leakage from the project’s tunnels would be monitored and reported” was not supported by the evidence because the certification “does not explicitly require monitoring and reporting to determine whether there is any leakage.” Accordingly, the court remanded the matter to the state to impose monitoring and reporting requirements but otherwise affirmed the certification. Legislative Developments California Legislates Restrictions on Data Center Energy Use and Grid Costs On September 21, 2026, California Governor Gavin Newsom signed seven bills broadly regulating data centers in the state. SB 1168 directed the California Public Utilities Commission to assess the energy used by data centers. It also requires the PUC to pass costs of transmission and distribution upgrades and load increases on to data centers, rather than customers. SB 886 and SB 887 compel data centers to pay for infrastructure upgrade and generation costs, and wildfire mitigation costs, in addition to imposing environmental review. The statutes additionally increase local oversight of data centers. AB 1577 imposes a monthly reporting requirement that requires data centers to supply energy consumption and efficiency data to the California Energy Commission. AB 2383 contains incentives for data centers to use onsite clean energy generation. Finally, AB 2469 and AB 2619 require data center developments to assess water supply and develop a water scarcity plan. The statutes also mandate statewide water reporting as a precondition to obtaining and renewing business licenses.

Regulatory Affairs Partner Randy Dann Joins Dorsey

News

Regulatory Affairs Partner Randy Dann Joins Dorsey