On June 28, 2018, the California Consumer Privacy Act of 2018 was signed into law.
This statute, which has an effective date of January 1, 2020, has been called the strictest consumer privacy law in the country. It gives California residents a broad range of new rights to control the collection and sale of their personal information and requires businesses that collect or sell personal information to comply with a variety of new requirements.
Who Does the California Consumer Privacy Act of 2018 Apply To?
The California Consumer Privacy Act of 2018 applies to for-profit businesses that do business in California, that collect consumers’ personal information, and that satisfy one or more of the following thresholds:
- Have annual gross revenues in excess of $25 million
- Buy, receive, sell, or share for commercial purposes the personal information of at least 50,000 consumers, households, or devices
- Derive 50% or more of their annual revenues from selling consumers’ personal information
This consumer privacy law also applies to affiliates of those businesses that share common branding and covers both online and brick-and-mortar businesses.
What Does the California Consumer Privacy Act of 2018 Cover?
Here is a broad overview of what the California Consumer Privacy Act of 2018 does:
- Gives consumers a right to request a business that collects personal information to disclose the categories and specific pieces of personal information that it collects about the consumer, the categories of sources from which that information is collected, the business purpose for collecting or selling the information, and the categories of third parties with which the information is shared
- Requires businesses to make disclosures about the information collected and purposes for which it is shared
- Gives consumers the right to request deletion of personal information and requires the business to delete that information
- Gives consumers a right to request that a business that sells the customer’s personal information disclose the categories of personal information that it collects, the categories of personal information that it sold about the consumer, and the identity of third parties to which the information was sold
- Requires a business that sells personal information to provide this information in response to a verified consumer request
- Authorizes a consumer to opt out of the sale of his or her personal information and prohibits businesses from discriminating against a consumer for doing so
- Requires a business that sells personal information to provide a link on its Internet home page titled “Do Not Sell My Personal Information” that consumers can use to opt out
- Lets businesses offer financial incentives to consumers for the collection of their personal information
- Penalizes businesses that violate the law
Although the California Consumer Privacy Act isn’t effective until 2020, businesses that collect or sell the personal information of California residents may want to find out now if this law applies to them, and if so, begin taking the necessary steps to make sure they will be in compliance once the law takes effect.