California Consumer Privacy Act

January 1, 2020. A day to recover from the holiday celebrations and get a jump start on your New Years’ resolutions. It is also when the California Consumer Privacy Act (CCPA) will go into effect.

The Act provides California residents with new rights when interacting with a business, regardless of whether they are paying customers or not. If you are a business owner and still unsure of what will be required in 2020 then read on. We have lots to cover and not a lot of time.

What is the California Consumer Privacy Act?

The CCPA is a piece of legislation enacted by the State of California with the goal of bolstering consumer privacy. The Act, following the EU’s General Data Protection Regulation, is one of the stricter pieces of legislation that focuses on consumer privacy issues.

The CCPA will impact consumers and business in many ways, with some notable examples including:

  1. New consumer rights to data access and erasure
  2. New consumer rights to opt-out of data selling
  3. A requirement to update service-level agreements with 3rd party data processors
  4. Compiling a data inventory and mapping instances of data selling

With the objective of giving consumers more control over their data, businesses across the U.S. will need to have a plan to comply by January 1, 2020.

Will Your Business Have to Comply?

All California consumers and businesses meeting specific criteria will fall under the provisions of the CCPA.

“Consumer”, as defined in the Act, is “a natural person who is a California resident, as defined in Section 17014 of Title 18 of the California Code of Regulations. . . .” This definition may include individuals who grew up in California and moved to another state as well as individuals who moved to California but did not grow up in the state.

The Act goes on to define “business” in great length. The following criteria are of particular importance:

  • Gross revenues in excess of $25 million annually
  • Derives 50 percent or more of its annual revenues from selling consumers’ personal information
  • A for-profit entity that conducts business in the State of California and collects personal information of consumers

Due to the ability for multiple interpretations, “personal information” as mentioned in the third bullet point deserves some further explanation.

This could be any information that references characteristics and behavior, both commercial and personal, and includes any inferences drawn from that information.

Examples of such personal information highlighted in the legislation include:

  • Household purchase data
  • Financial information
  • Family information
  • Biometric data
  • Education information
  • Geo-location data

Penalties for Non-Compliance

Companies found to be in violation of the CCPA can face hefty fines. Regulators can fine a business up to $2,500 for each unintended violation and up to $7,500 for each intentional violation.

Fines ranging from $100 to $750 can be assessed for each consumer involved in a data breach incident.

Will the CCPA Impact Your Digital Marketing Campaigns?

Business owners should prepare for the issues they may be facing in a few short months. Digital marketing uses a large amount of data to serve the right ad, to the right person, at the right moment.

Marketers that rely on second- and third-party data should explore how to leverage their first-party data. While your business may not be large enough to classify as a “business” under CCPA language, many data brokers and ad tech vendors are large enough. It is noteworthy that working with a vendor who is required to be compliant but isn’t can expose your business to potential liability.

It is possible that the CCPA causes some data brokers to exit the business. This would result in fewer providers and ultimately higher rates for data.

Should data become more expensive, or if consumers exercise their rights en masse, targeting as we know it today will become less effective.

Companies relying on highly targeted marketing solutions provided by data brokers and ad tech vendors should begin to explore other methods of reaching consumers.

How Your Company Can Prepare for the CCPA

Business owners with anxiety over the looming deadline can take action today to be ready for Jan. 1st, 2020.

Update your policies

Under the CCPA consumers have the right to request details regarding what type of information is collected, the source of that information, how it was collected and how it is or will be used. Updating your Privacy Policy as the first line of defense can help consumers quickly and easily find the answers to these questions.

Train, Train, Train

Identify the people in your company who handle consumer data and ensure they know the regulation. Because ignorance will not be an excuse, it is critical that your teams are up to speed on the new requirements. Furthermore, it may be helpful to draft a reference sheet that is easily shared across teams and that can be updated as needed.

Get Organized

Regardless of how much you prepare your staff and update your Privacy Policy, some consumers will still request their data. Businesses must provide this data at no cost to the consumer. Having an organized process and a well-constructed database will help your company quickly and accurately compile reports as they are requested.

Ultimately, marketers can adopt one of two mindsets regarding the CCPA. The first is that it is an onerous piece of legislation that is overstepping. The second is that the CCPA is an opportunity to develop a competitive advantage. Invest in consumer-consented first-party data and be transparent with how you collect data and why. In an age where only 56 percent of consumers trust businesses, doing the right thing is an advantage.

Corbin Bridge is the founder and CEO of Windtalker, a transparent, end-to-end programmatic ecosystem. Windtalker is committed to providing a transparent, economically efficient, and brand-safe ecosystem for quality advertisers and publishers. Corbin has spent most of his life and professional career around advertising. Previously, he was the Director of Sponsorship Accountability for the leading U.S. media audit firm. Prior to that role, he was a marketing analyst for a leading entertainment company in Las Vegas.

California Consumer Privacy Act stock photo by Martial Red/Shutterstock