On January 1, 2020, the California Consumer Privacy Act (CCPA) will officially go into effect, marking the beginning of a new era for both marketers and customers. Perhaps the most comprehensive and thorough of its kind, this law puts control of personal data and information into the hands of users. The CCPA was created in part as a reaction to the Cambridge Analytica breach of 2017, which also uncovered a gross mishandling of user data by Facebook in 2016.
However, California’s push for greater accountability and privacy comes as no great surprise. In 1972, California amended its own constitution to make individual privacy a fundamental and undeniable human right. Though this position was ratified into law decades before the digital boom, it has huge implications for the use of personal data by companies in the state.
So, how might the CCPA affect your marketing and business in the state of California? How exactly can businesses prepare for the fast-approaching change? Let’s take a look at who this bill protects, what companies will be impacted, and what new developments you can expect from the California Consumer Privacy Act in 2020.
Types of Companies Affected by CCPA
A business does not need to physically be located in California to be under the jurisdiction of CCPA. If you do business in the state of California with clients, or have remote employees there, the law is in full effect.
Secondly, this law will be in place for any for-profit company in or doing business in California that meets one of the following conditions:
- Has an annual revenue of $25 million or more
- Receives information or data on over 50,000 consumers, households, or devices annually
- Generates half of all company revenue from selling data
Keep in mind that businesses don’t need to meet all three conditions, just one. If your business’ marketing efforts check off even one of these boxes, the CCPA has jurisdiction over your work.
Rights Covered Under the California Consumer Privacy Act
The personal data marketers collect goes far beyond a name or location. All the websites, cookies, social media applications, and lead generation tools used daily collect a plethora of personal information from consumers. In response, the CCPA was written to cover the full spectrum of data and return control to the customer. This would include:
- Real names or aliases
- Mailing addresses
- Order histories
- Internet browsing history and favorites
- Social Security, driver’s license, and passport numbers
- Biometric information such as height, weight, fingerprints, or speech
- Location and coordinates
- Job history and professional resume
- Private or sealed school records
- Metadata
Once the legislation goes into effect, residents are automatically guaranteed the following rights:
- A right to know what personal information marketers gather about them, as well as how and where it was acquired, and if the data is sold or shared with third parties.
- The right to opt out of having their data or personal information sold.
- The right to have all information held by a specific company deleted upon request.
- The right to receive documented copy of all stored information via phone, email, or letter.
- The right to fair service, equal price, and the same treatment regardless of whether they opt out or not.
Failure to meet any of these goals may be cause for penalty. As of now, the California Attorney General has the ability to impose fines between $2,500 and $7,500 per violation of the CCPA. But beyond those infractions, a citizen of California may have grounds to sue for a company or even put together a class-action lawsuit. This could lead to massive fines and setbacks for any business that doesn’t follow the law to the letter.
Why Does the California Consumer Privacy Act Matter to Marketers?
Though it may be the first of its kind, the CCPA is only the beginning of this kind of legislation in the United States. Currently, similar privacy laws are being argued in legislatures from New York to Nevada. Though these bills will likely use the CCPA as a framework or reference, each of these laws will be different, with its own set of rules, boundaries, and nuanced practices. In short, things are about to get complicated, especially for those collecting, buying, or selling private information in multiple states or regions. Whether you’re doing business in California or not, this law and many more like it are going to play a huge part in your company’s future.
But this legislation is not meant to only be a massive penalty against companies collecting data. Rather, it’s a chance for us as marketers to do better by our customers and create healthier relationships with the public. The CCPA is a way to encourage marketers to minimize the amount of data they store or need. Not only does this make a business more trustworthy, it also protects both parties in case of a breach or crash. Review your data storage and you may realize that it’s time to declutter and delete unnecessary personal data.
Of course, when you’re gathering data from a variety of sources, it can get confusing keeping track of them all. If you’re looking to reflect on your company’s data collection, it’s a good idea to team up with a trusted global suppression list management partner like UnsubCentral. Our software connects all the disparate CRMs, multiple ESPs, and combined marketing automation tools to make sure you have a complete picture of your user data. Contact us today to learn how we can help you get ready for the CCPA and whatever is coming next.