CCPA

California’s comprehensive data privacy law that went into effect on January 1, 2020. It is designed to protect California residents’ privacy rights and give them more control over their personal information.

CCPA History

• The CCPA was introduced as Assembly Bill 375 in 2018 and was signed into law on June 28, 2018.
• It was amended by Senate Bill 1121 on September 23, 2018, to clarify some provisions and delay enforcement until July 1, 2020.
• The CCPA was influenced by the European Union’s General Data Protection Regulation (GDPR), which took effect in May 2018.

CCPA Key Elements

• Scope: The CCPA applies to for-profit businesses that collect California residents’ personal information, do business in California, and meet at least one of the following thresholds:
  • Annual gross revenues over $25 million
  • Buy, receive, sell, or share personal information of 50,000 or more California residents, households, or devices annually
  • Derive 50% or more of their annual revenue from selling California residents’ personal information
• Consumer Rights: The CCPA grants California residents the following rights:
  • Right to know what personal information is collected, used, shared, or sold
  • Right to delete personal information held by businesses and their service providers
  • Right to opt-out of the sale of personal information
  • Right to non-discrimination for exercising CCPA rights
• Personal Information: The CCPA defines personal information broadly, including identifiers, biometric data, geolocation data, internet activity, professional or employment information, and inferences drawn from such information.
• Obligations for Businesses: Under the CCPA, businesses must:
  • Provide notice to consumers at or before data collection
  • Create procedures to respond to consumer requests to opt-out, know, and delete
  • Respond to requests from consumers to know, delete, and opt-out within specific timeframes
  • Verify the identity of consumers making requests
  • Disclose financial incentives offered in exchange for the retention or sale of personal information
  • Maintain records of consumer requests and how they responded for 24 months

CCPA Impact on Sales and Marketing

• Privacy Policies: Businesses must update their privacy policies to include CCPA-specific information, such as a description of California residents’ rights and how to exercise them.
• Opt-Out Links: A clear and conspicuous Do Not Sell My Personal Information link must be provided on their website homepage for businesses that sell personal information.
• Data Mapping: Sales and marketing teams must map out the personal information they collect, use, and share to ensure compliance with the CCPA.
• Consent Management: Businesses must obtain explicit consent from consumers before selling their personal information, especially for minors under 16.
• Third-Party Agreements: Sales and marketing teams must review and update contracts with third-party service providers to ensure they comply with the CCPA’s requirements.
• Training: Employees handling consumer inquiries about the CCPA should be trained on the law’s requirements and how to process consumer requests.

The CCPA has significantly impacted how businesses collect, use, and share personal information for sales and marketing purposes in California. Non-compliance can result in substantial fines and legal action.