Which businesses are affected by the CCPA?
The act applies to California residents and the following types of businesses:
- For-profit entities that do business in California and collect personal information of consumers. This also applies to businesses with a website that can be viewed by California residents, whether or not they're in California at the time - which, in effect, means practically every business.
- Businesses that have annual gross revenues in excess of $25 million.
- Businesses that process the personal information of at least 50,000 consumers, households or devices every year. This also applies to businesses that have this number of California residents in its email database.
- Businesses that derive 50 percent or more of their annual revenue from selling consumers' personal information.
"The new bill has a broad definition of 'selling personal information,' which also includes sharing data in return for 'valuable consideration.' This means that some businesses, which don't seek financial compensation from sharing personal data, might find that they still fall under the CCPA's definition of 'selling.'
"The definition of selling in this law captures not just the transfer of information for money, but also information gained from exchanges - which happen all the time for business or government planning. It is a broad definition that we need to think about."
Consumers know their rights
- The right to know what personal information is collected, used, shared or sold, both as to the categories and specific pieces of personal information.
- The right to delete personal information held by businesses and by extension, a business's service provider.
- The right to opt-out of sale of personal information. Consumers are able to direct a business that sells personal information to stop selling that information. Children under the age of 16 must provide opt in consent, with a parent or guardian consenting for children under 13.
- The right to non-discrimination in terms of price or service when a consumer exercises a privacy right under CCPA. However, notes cybersecurity writer Laura Hautala for , that although companies can't turn away users if they opt out of the sale of their data, they can give people a stripped-down version of their offerings.
A brief history of the CCPA
Although the CCPA is the strongest, most sweeping privacy act in the United States, it is ambiguous in some areas and open to interpretation (or misinterpretation). If you're confused, you're not alone. Even lawyers such as Determann express their opinion that the bill was rushed. "The law came out of just a few days of negotiations. It was not completely thought through, and I think it can come with unintended consequences."
"In early 2018 a California real estate developer spearheaded an effort to include a new privacy law - the Consumer Right to Privacy Act of 2018 - on the November 2018 California ballot. By June 2018, supporters of the initiative had gathered enough signatures to earn a place on the November ballot. In response, California legislators, working with representatives of affected California businesses and other interest groups, quickly negotiated and passed a substitute bill - The California Consumer Privacy Act of 2018 - the CCPA - in exchange for an agreement to drop the more restrictive text in the Consumer Right to Privacy Act from the November ballot."
How businesses must comply
Consumers also have the right to access the personal information a business has on them. The CCPA requires at least two ways of doing so, including at a minimum a toll-free phone number. Users who ask to see their personal data should be granted access within 45 days. If customers request their data be deleted, businesses must comply.
Paying the penalties
Is this the way the cookies crumble?
Users who opt out of providing data or allowing a website to track their activities through cookies - small text files stored on your browser when you visit or interact with a website or advertisement - make targeting ads that much more difficult. Dean points out:
"Those who opt out will probably see fewer hyper-target ads, the kinds that show users a product they left unpurchased halfway through the checkout process, or that seem to eerily promote a store they visited a few days earlier. After multiple deletion requests, users could eventually see only ads that are related to the page they are visiting - car ads on an article about cars, or meal-delivery ads on a food website."
"Google signed on to this system in December and gave its customers - which include most of the websites on the internet - a toolkit for building this opt-out system into their own sites."
Google Ads Help provides detailed information on its site regarding how it helps advertisers, publishers and partners manage their CCPA compliance.
Is this the beginning of the end for online advertising?
"Users are finally realizing just how costly free can be - and this might be the driver for change in the way consumers treat their own data. A service in exchange for data is no longer enough - users want to control their own data and whom it is shared with, as well as see real, tangible benefit from giving up information about themselves."
"California's new data privacy law signifies the introduction of a specific, individual right for customers to opt out of having their personal information sold. As these transparency standards are backed by legislation, it's increasingly important for brands to remain honest with their customers if they want to retain their loyalty."
The take-home message
Making sure your business is CCPA compliant doesn't need to be an overwhelming process. Virtual Stacks Systems offers comprehensive , Google Ads and PPC services , and social media marketing services that can help you make compliance seamless. to learn more.
