[co-author: Jason Schultz]

Yes. 

On-site tracking refers to the practice of scanning attendees’ badges manually (e.g., bar code) or automatically (e.g., RFID chip in badges read at doorways). Organizers track this information for various reasons such as to award credit for attending various panels (e.g., continuing education verification) or for their own analytics (e.g., to track session attendance for future room allocation or to determine future programming). 

Assuming that the CCPA applies to a conference organizer (e.g., the organizer does business in California and meets the minimum revenue or data subject thresholds), nothing within the CCPA prohibits the organizer from collecting on-site tracking data, or using that data for first party marketing (e.g., to market additional conferences to attendees, or services at a conference being attended).  The CCPA would require that a conference organizer disclose that they are tracking attendee behavior as well as disclose their purpose for tracking – including the use of the data for marketing purposes.  While the disclosure might come in the form of a privacy policy provided to attendees, it could be less formal – such as via a poster or sign at check-in.  Conference organizers should also consider the additional CCPA related implications:

• If the organizer intends to sell the data to third parties, the organizer will need to provide a “Do Not Sell my Information” link in their online privacy notice.
• An organizer may receive a request from an attendee for access to their information. In response to such a request, they may need to disclose all of the data collected about a particular attendee (e.g., locations tracked, activities recorded).
• An organizer may receive a request from an attendee to delete their information. In response to such a request, they may need to have the ability to selectively delete information about the attendee, or to explain to the attendee why such information is not required to be deleted.  For example, if the information is being collected for a purpose other than marketing – such as security at the conference – the organizer may be able to deny the request on those grounds.

If the organizer relies upon a third party to collect, host, analyze, or manage the data collected about attendees, the contract with the third party should meet the “service provider” requirements of the CCPA.

For more information and resources about the CCPA visit http://www.CCPA-info.com. 

This article is part of a multi-part series published by BCLP to help companies understand and implement the General Data Protection Regulation, the California Consumer Privacy Act and other privacy statutes.  You can find more information on the CCPA in BCLP’s California Consumer Privacy Act Practical Guide, and more information about the GDPR in the American Bar Association’s The EU GDPR: Answers to the Most Frequently Asked Questions.