You may not have noticed, but between the parades and football games, there was a seismic event on New Year’s Day 2020 that fundamentally changed the way we treat privacy in the United States. The California Consumer Privacy Act (or CCPA) went into effect, requiring businesses to give California residents an unprecedented level of access to, and control over, their personal information.
“The CCPA appears to apply to California residents, no matter where they are,” according to Jon Brescia, the Vice President of the BBB National Program’s Digital Advertising Accountability Program during a discussion on the > Better Series podcast. “You can be a California resident, be on vacation or spend a month working on a contract in a different state, it seems like you’re still covered by this (law).”
Under the CCPA, businesses that are subject to the law must: notify consumers they collect personal information about them and how they use the information; give California residents access to the information; delete certain personal information on request; and agree not to sell the information to third parties for marketing purposes among other responsibilities. Brescia describes the ways businesses are expected to comply as “very fuzzy stuff.”
“How do they know who that person making the request is?” asked Brescia. “How do they verify the identity of this person? What data internally is linkable to this person? What reasonable efforts must the business take to link the data to this person?”
Cobun Zweifel-Keegan, deputy director of the BBB National Program’s Privacy Initiatives, notes the California Attorney General has proposed regulations that may clarify compliance issues. “You have strict requirements, but not necessarily specific requirements that leave (the CCPA) open to interpretation.”
Enforcement of the CCPA is set to begin in July. To learn more about how the CCPA may impact your business – even if you are not located in California – listen to the full episode of the BBB National Program’s > Better Series podcast.