Just when you settled into a post GDPR routine, there is a new consumer privacy law looming. The California Consumer Privacy Act of 2018, also known as CCPA, goes into effect on January 1, 2020, and will have implications for marketing to consumers.
In a nutshell, CCPA will empower people to know the types of personal information businesses collect about them, and give them the right not to agree to the sale of their personal data to other parties. More specifically, CCPA introduces the following:
- Right to know all data collected by a business on you
- Right to say NO to the sale of your information
- Right to DELETE your data
- Right to be informed of what categories of data will be collected about you prior to its collection, and to be informed of any changes to this collection.
- Mandated opt-in before sale of children’s information (under the age of 16)
- Right to know the categories of third parties with whom your data is shared
- Right to know the categories of sources of information from whom your data was acquired
- Right to know the business or commercial purpose of collecting your information
- Enforcement by the Attorney General of the State of California
- Private right of action when companies breach your data
What Businesses Will Be Affected by the CCPA?
While the CCPA could be influential in shaping additional consumer data regulations, for now the law’s scope is limited to mid-to large-sized businesses that do business in California. Companies are subject to the terms of the CCPA when they meet one of the following conditions:
- Annual revenue exceeds $25 million
- Company receives data from at least 50,000 people, households, or devices every year
- Company earns at least 50 percent of its annual revenue from selling personal data
Are There Any Penalties?
Currently, penalties in the law can include up to $7,500 per incident. Meaning that a data breach involving 10,000 customers could end up costing a business as much as $75 million.
When Does the CCPA Go into Effect?
Technically, the CCPA went into effect when it was signed into law on June 28, 2018. However, the requirements will go into effect on January 1, 2020. That said, January 1 is not the end of the line. The California Attorney General has until July 2, 2020 to publish regulations. (Legislation is what the legislative body passes. Regulations are the standards for enforcing the law.) Also, the Attorney General cannot bring legal action against violators of the CCPA until either July 1, 2020 or six months after the final regulations are published, whichever comes first. More to come…
