A state statute intended to enhance privacy rights and consumer protection for residents of California, the California Consumer Privacy Act (CCPA) went into effect on January 1, 2020. The bill was passed by the California State Legislature and signed into law by Governor Jerry Brown on June 28, 2018, to amend Part 4 of Division 3 of the California Civil Code. Officially called AB-375, the act was introduced by Assembly Member Ed Chau and State Senator Robert Hertzberg. Amendments to the CCPA, in the form of Senate Bill 1121, were passed on September 13, 2018, with additional substantive amendments signed into law on October 11, 2019. The CCPA was influenced by the European Union's General Data Protection Regulation (GDPR), which took effect in May 2018.
Scope and Applicability
The CCPA applies to for-profit businesses that collect California residents' personal information, do business in California, and meet at least one of the following thresholds:
- Annual gross revenues: Over $25 million
- Data volume: Buy, receive, sell, or share personal information of 50,000 or more California residents, households, or devices annually
- Revenue source: Derive 50% or more of their annual revenue from selling California residents' personal information
Consumer Rights
The CCPA grants California residents the following rights:
- Right to know: What personal information is collected, used, shared, or sold
- Right to delete: Personal information held by businesses and their service providers
- Right to opt-out: The sale of personal information
- Right to non-discrimination: For exercising CCPA rights
Obligations for Businesses
Under the CCPA, businesses must:
- Provide notice: To consumers at or before data collection
- Create procedures: To respond to consumer requests to opt-out, know, and delete
- Respond to requests: From consumers to know, delete, and opt-out within specific timeframes
- Verify identity: Of consumers making requests
- Disclose financial incentives: Offered in exchange for the retention or sale of personal information
- Maintain records: Of consumer requests and how they responded for 24 months
Impact on Sales and Marketing
The CCPA has significantly impacted how businesses collect, use, and share personal information for sales and marketing purposes in California. Key changes include:
- Privacy policies: Must be updated to include CCPA-specific information
- Opt-out links: A clear and conspicuous Do Not Sell My Personal Information link must be provided on the website homepage
- Data mapping: Sales and marketing teams must map out the personal information they collect, use, and share
- Consent management: Businesses must obtain explicit consent from consumers before selling their personal information
- Third-party agreements: Contracts with service providers must comply with CCPA requirements
- Training: Employees handling consumer inquiries must be trained on the law's requirements
