California Consumer Privacy Act (CCPA)

You must comply with the CCPA when working with any California resident’s information when at least one of the following three criteria apply to your business:

1. Annual gross revenue of $25 million or more; or
2. Buys, receives, sells, or shares the personal information of 50,000 or more consumers, households or devices per year
3. Earns 50% or more of its annual revenue from the selling of consumers’ personal data

There are 5 major components to the CCPA.
They give California residents the right to:

1. Know what personal information is being collected about them
2. Know whether their personal information is being shared and to whom
3. Opt-out of the sale of personal information
4. Access the personal information you’ve collected
5. Equality in service and price even if they’ve exercised their privacy rights

In the context of CCPA, personal information is quite broadly defined and likely includes all data you’ve ever collected for a consumer or digital visitor. The CCPA specifically defines it as information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked directly or indirectly with a particular consumer or household.

Either before collecting or at the time of collecting personal information, your business has to provide the categories and specific pieces of information collected; the sources where that information was collected from; the purpose of the collection; which categories will be shared or sold; and a disclosure of the consumer’s rights.

What constitutes compliant disclosure for collection is still being decided through public forums and will ultimately be decided by the California Attorney General. However, there are some basic requirements that always must be met:

• Clear and prominent link to your privacy policy
• The privacy policy must include the disclosure elements listed above, including all third parties who may receive the personal information
• A clear and conspicuous link titled “Do Not Sell My Personal Information” on the home page and privacy policy.

The CCPA discusses sharing data with third parties and the “sale” of personal information. The distinction between these two is still being defined. Selling personal information is held to a higher standard than sharing.

While the definition of “sale” under CCPA is broad, note that it’s more than just a monetary exchange. A “sale” is any kind of consideration or benefit you get in the exchange of data, eg, sharing data into a cookie pool gives your company benefits. This is also considered a “sale” of data.

In general, you’re sharing and not selling when one of the following apply:

• Disclosing under the intentional direction of the consumer
• Using an identifier to indicate to a third-party that a consumer has opted-out of selling of their data
• Disclosed to a service provider. To qualify, the disclosure must be for a business purpose; pursuant to a written contract that prohibits the further disclosure of the personal information
• You’ve provided a compliant notification to the consumer that the information will be disclosed in this way
• The service provider doesn’t further use the personal information except to accomplish the business purpose.

The CCPA requirements for the sale of personal information has three components:

• Disclosure of any selling of personal information as defined by the Act. At minimum this must be in your Privacy Policy. Although not defined yet, it will likely also need to be disclosed more prominently at the point of data collection.
• A prominent and conspicuous link titled “Do Not Sell My Personal Information” on your home page and in your privacy policy.
• A place on your website where the consumer can exercise their various privacy rights under the Act including opting-out the sale of their personal information.

The best solution to CCPA compliance is to have:

• an enterprise-grade notice-and-consent platform installed to ensure consent & notification compliance
• a tool to identify all daisy-chained third-party vendors that execute at run-time on your site to ensure that you know which third parties you’re potentially sharing personal information with