The California Consumer Privacy Act (CCPA) will require businesses processing personal information (PI) of 50,000 or more California consumers, earning more than $25 million in annual gross revenues, or deriving at least 50% of their annual revenue from PI sales to comply with new regulations governing the processing of consumers’ PI. The definition of PI is broader than the General Data Protection Regulation (GDPR) in that it includes any PI that identifies “households” and not just individuals. Further, the PI definition includes a business’s proprietary “inferences” drawn from other PI to develop consumer profiles or other analytics. Under the CCPA, companies will be obligated to respond to the following eight consumer rights:

  1. Abbreviated Disclosure Right Applicable to Businesses that Collect PI: Consumers can request that a business disclose the categories and specific pieces of PI collected about them.
  2. Expanded Disclosure Right Applicable to Businesses that Collect PI: Consumers can request that a business disclose the categories and specific pieces of PI collected, sources of PI, its business or commercial purpose, and third parties to whom PI is shared.
  3. Right to Request Information from Businesses that Sell or Disclose PI for a Business Purpose: Consumers can request that a business disclose for the previous 12 months the categories of PI collected and sold, third parties to whom PI is sold, and PI disclosed for a business purpose.
  4. Right to Opt-Out of the Sale of PI: Consumers can direct a business to stop selling their PI to third parties and can receive notice of these rights within a business’s privacy policy containing a separate link to a “Do Not Sell My PI” web page.
  5. Right to Opt-in for Children: Businesses need opt-in consent from the parent/guardian of a child before selling the child’s PI.
  6. Right to Deletion: Consumers can request that a business delete their PI.
  7. Right to Access and Portability: Consumers can request access to their PI in a portable format.
  8. Right to Not Be Discriminated Against for Exercising Any of the Consumer Rights: Consumers may not be discriminated against for exercising any of these rights under the CCPA.

Note that each of the rights is subject to a number of general defenses and certain specific ones. We have undertaken a very detailed analysis of how this law may impact digital advertising and would love to share our thoughts. Dominique Shelton will be speaking at the International Association of Privacy Professionals Privacy Risk Security Conference in Austin, Texas as part of the CCPA workshop on October 17, 2018. She will be comparing the CCPA to the GDPR to show how the CCPA requires additional compliance requirements above and beyond the GDPR.