Back in January, you may have noticed that many businesses updated their privacy policies; this was in response to the California Consumer Policy Act (CCPA). The CCPA went into effect on January 1, 2020, and is now enforced as of July 1st 2020.
The California Consumer Policy Act is a law that protects the privacy rights of California residents. It applies to for-profit businesses do business in California or does business with California residents and meet one of the following three criteria:
• An annual gross revenue greater than $25M
• Buy/receive, sell/share personal info of 50,000 or more California residents or households or devices for commercial purposes
• Make 50% or greater of your annual business revenue by selling California residents’ personal information.
Even if you are a small business, the second criteria could apply to you. For example, tracking website visitor information like with Google Analytics or on an email list are considered collecting personal information. If a small business has over 50,000 California residents visiting their website within a year or on their email list, they are subject to the CCPA. If you are approaching any of the criteria it would be best to make updates as well.
Facebook Pixel and CCPA. Facebook Pixel tracks website visitors and social media users to help with advertising and conversions tracking. If you use Facebook pixel, the second criteria applies to you. By placing Pixel on your website, you contribute to Facebook’s database which has over 50,000 California residents. Because the Pixel is storing personal data about the individual users, you must disclose this in your privacy policy and give California residents the option to opt-out.
What are the penalties of the California Consumer Act?
If a business intentionally violates the CCPA the maximum fine is $7,500. Other violation lacking intent face a maximum fine of $2,500. Consumers can also file lawsuits against companies violating the CCPA and collect and damages fee. On average the plaintiff can collect between $100 and $750 for damages.
The CCPA requires that businesses provide an opt-out option if consumers do not wish for the business to collect or track any of their personal data. On the website should include a “Do not sell my information” consent.
Personal data includes, but is not limited to, real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol (“IP”) address, email address, account name, social security number, driver’s license number, or passport number.
Furthermore, in your website’s privacy policy, share what third-party or first-party tools and websites will have access to the consumer information you collect. For example, if you use Facebook Pixel, that should be noted in your privacy policy.
Even if your company does not meet the CCPA thresholds, it is good business practice to let your audience know what data you are collecting, where it is stored, who will have access to it, and how you use it. These details should all be in your website Privacy Policy.
In response to the California Consumer Policy business should:
If you would like us to audit your website for third-party scripts, need help revising your privacy policy, or if you have any additional questions, please contact us at:
Phone: (330)-425-0922
Email: sales@igvinc.com
