As the CCPA’s effective date approaches, businesses are actively monitoring how companies are updating their privacy notices to comply with the new disclosure requirements of the Act.  While many companies are prepared to update their privacy notices at the end of the year, notices that are preemptively changed before year-end are being reviewed and scrutinized for trends and signs of any industry standard practices surrounding such things as the disclosure of the “sale” of information or the collection, and sharing, of information by “enumerated category.”

In order to help companies understand and benchmark industry practice, BCLP analyzed a random sample of the privacy notices of Fortune 500 companies.[1]  As of December 13, 2019, 20% of the companies in the sample had released CCPA-revised privacy notices; 80% of companies had not updated their privacy notices.  

The net result is that so far updating privacy notices remains the exception and not the rule.  While the average “age” of current privacy notices (i.e., the time elapsed since a privacy notice was last updated) has shortened considerably in the past month, it still remains relatively high at 583 days since last update.

1. Using a computer random number generator, BCLP selected 6% of the companies listed among the Fortune 500 in 2019.  Revenues for the selected companies ranged from $85 billion to $5 billion.  While BCLP did not conduct statistical analysis to determine whether the sample selected accurately represented the range of businesses in the United States, the sample contained companies focused on retail, financials, food, agriculture, manufacturing, entertainment, and energy.  

[View source.]