The California Consumer Privacy Act of 2018 (the “CCPA”) and the related proposed Attorney General Regulations (the “Regulations”) provide California consumers with increased privacy rights and protections with respect to their personal information. Businesses that are subject to the CCPA must comply with various notice obligations and requirements related to the collection, deletion and sale of personal information. The California Attorney General intends to begin enforcing the CCPA and the Regulations on July 1, 2020.

This client alert provides a summary of the factors that subject a business to compliance with the CCPA and the Regulations, as well as the notices required thereunder. This is simply a summary of some key points, so check with your ECJ attorney for the critical details regarding the CCPA and the Regulations. Client alerts related to other important aspects of the CCPA and the Regulations will be sent in the coming days. All CCPA-related alerts can be found by accessing our blog: Bytes, Sites & Rights.

Covered Businesses

A business is subject to the CCPA if it (1) is operated for profit; (2) collects consumers’ personal information; (3) determines the means of processing personal information; (4) does business in California; and (5) meets one or more of the following thresholds: (i) has annual gross revenues in excess of $25,000,000; (ii) annually buys, sells, receives or shares for commercial purposes personal information of at least 50,000 consumers, households or devices; or (iii) derives at least 50% of its annual revenues from selling personal information.

Required Notices

If a business is subject to the CCPA, it must provide consumers with certain notices related to the collection of personal information. The notices are as follows:

• Privacy Policy: The purpose of the privacy policy is to provide consumers with a comprehensive description of a business’ online and offline practices regarding the collection, use, disclosure, and sale of personal information and of the rights of consumers regarding their personal information. 
• Notice at Point of Collection: A business that collects personal information must provide a notice to the consumer at or before the point of collection. The purpose of this notice is to provide consumers with timely notice about the categories of personal information to be collected from them and the purposes for which such personal information will be used.
• Notice of Right to Opt-Out: A business that sells consumers’ personal information shall provide consumers with a notice of the right to opt-out of such sale. For a business that operates a website, the notice must include, among other things, an interactive form by which a consumer can submit a request to opt-out online.
• Notice of Financial Incentive: A business that offers a financial incentive or price or service difference related to the collection, retention or sale of personal information must provide consumers with a notice of financial incentive. The purpose of this notice is to explain to the consumer the material terms of the financial incentive or price or service difference the business is offering so that the consumer may make an informed decision about whether to participate.