Every day our smartphones, computers and tablets collect information about who we are. They know where we spend the most time, what time of day we access the internet, what websites we go to, and the applications we download. With this data, companies build profiles about their users and sell them to third parties. Effective January 1, 2020, the California Consumers Privacy Act grants new rights to Californians concerning what companies are allowed to do with their data. This legislation protects and legally gives Californians the right to know exactly what goes on with the data companies collect about them.
One of the most significant changes CCPA brings is requiring companies to tell consumers what type of data they are collecting about them. This includes any personal information regarding online activity, frequented locations and websites, facial recognition data, and even the personalized ads they see online.
Another attribute of the new policy is that consumers are able to demand companies to delete any information that has been collected about them. Additionally, businesses are required to share with their consumers what third parties have received, bought or had access to their data.
The CCPA also grants consumers the right to deny companies the ability to sell their personal information to third parties and limits what they can do with the data of minors. When it comes to selling the personal information of children, businesses will require consumers to opt-in rather than opt-out. If the child is between 13 and 16 the company must receive opt in consent directly from the individual before selling their information to third parties. However, if the child is below 13, the consent must come from their parent or guardian. If the company collecting the data does not intend to sell the information, or if it does not have “actual knowledge” of the user’s age, it does not have to provide opt-in or opt-out services to the consumer. Companies are considered to have “actual knowledge” if they collect information about a person’s age, birth year, or year in school.
So what does this mean for the companies collecting all of this data? For starters, they need to know whether or not any of these new rules apply to them. According to Attorney General Xavier Becerra, businesses are subject to the CCPA if they have a gross annual income greater than $25 million, has 50,000 or more consumers or user records, or if they get 50% or more of their revenue from selling the personal information of their users. From there, companies will need to set to work ensuring they are in compliance with the new regulations. They will need to have processes in place to ensure that minors and their parents are giving clear consent before selling any information to third parties as well as ways to manage and respond to various user requests and demands. Businesses must also have ways to verify the identity of the users who request to know or delete data.