How To Prepare To Be CCPA Compliant
Like with any law, you will face penalties if you don’t comply with the California Consumer Privacy Act (CCPA). Since businesses are at risk of being held liable if they fail to follow the CCPA we think it’s a pretty smart question to be asking!
What do we mean by selling?
In most cases, if your company sells your consumer data, you will already know. But for those of you who aren’t sure, this is when a company or business sells personal information about their customers and clients to advertisers. The company benefits from the money and the advertisers benefit from extended reach.
Mention Consumer Rights
It is also important to include what rights a consumer may have under the CCPA. This should include language for both of the following:
- the right to make requests
- the right to not provide their personal information (opt-out)
Your policy needs to be explicit about what aspects of it apply to who so that you don’t run into legal trouble down the line.
This is a bit of a preventative measure, but if you want to learn how to be CCPA compliant, this a big part of it.
Say you have a consumer that finds out a month later that they have been eligible for the rights of CCPA without knowing it. They provided their personal information thinking they had to and you sold it. Now they’re complaining because they didn’t want to provide the information and they didn’t want it sold, and they’re going to take it to court.
FURTHER READING: What is the California Consumer Privacy Act?
Explain Why You’re Collecting User Data
If the reason you ask for personal information is that you need it to adequately provide a quality service then this will only be to your benefit. Consumers can relax knowing that your reasons are nothing more than product-related.
If the reason is that you want to sell personal information, consumers can go either way. Maybe they’ll be relieved that there’s nothing sketchy going on with their name and email. And maybe they’ll take a step back and say “No, thanks. I’ll opt-out.”
But as long as you were upfront and fully disclose why you are asking for personal information, you’ll legally be in the clear.
How Can Consumers Opt-Out
This is the biggest one. Users need to not only know how their information is being collected but how they can exercise their rights as granted by the CCPA.
First, How Is The Information Being Collected?
Are they providing it themselves or are you going elsewhere to acquire the information? Does being on their site at all mean that some of their personal information has been collected?
It also needs to tell them how they can opt-out of giving personal information. Is there a button that they need to click on? Is there a link? Do they need to fill out a form online? If so, how can they access this form?
Provide them with two or more methods for how they can make requests. At a minimum, you should provide a phone number and a web address. This is not a step that can be skipped. The way in which a consumer may exercise their rights needs to be readily accessible.
How Will You Verify Identity Of Consumers To Process Their Requests
This will force you to have a method, which will help you stay CCPA compliant since you will be able to acquiesce to their request in a timely fashion. It will also reassure consumers that no one else will be able to access or change their personal information.
FURTHER READING: Who Must Be CCPA Compliant? Does it apply to me?
Although this may not be relevant for your company, if any part of your business involves minors, you need to obtain their consent to access their personal information.
According to the CCPA, a minor is someone under the age of 16.
- For minors between the ages of 13 and 16, you can obtain consent directly from them.
- For minors under the age of 13, you must obtain consent from their parent or guardian.
You need to have a consistent and thorough method for obtaining this consent, and you should always keep a record proving that consent was given. These records should be easily accessible and kept together should you need to provide proof down the line.
Treatment of Individuals Who Opt-Out
If a consumer opts out of giving you their personal information, the CCPA prevents you from treating them any differently.
This means that you cannot:
- raise the price of a product/service
- alter the quality of a product/service
- or deny the product/service altogether
The only exception to this is if you require the consumer’s personal information to maintain the quality of the product/service or to provide the product/service at all.
How Will You Handle Consumer Requests?
You need to have a process for handling consumer requests once the request has been received.
This process is completely up to you; however, all requests must be completely free of charge and you must respond to and/or comply with the request within 45 days of receiving it.
How Will You Secure Consumer Data?
This is a preventative measure. If you want to ensure that there is no risk of a consumer suing your company, you will want to strengthen your security regarding the handling of personal information.
Do what you can to make sure that no one else can get access to it without your permission. The less risk there is of an unauthorized person accessing or mishandling the information, the less risk there is of a lawsuit.
How Will Your Homepage Need To Be Changed?
For the most part, your homepage can stay exactly as it is—and you will not have to forfeit creativity or functionality.
However, your homepage does need to have a “Do Not Sell My Personal Data” link somewhere on it. The link should be easily seen and accessed, and it needs to be functional.
Users must be able to access this link and perform this action without needing to make an account on your site.
Broaden Your Understanding of How To Be CCPA Compliant
One of the best things that you can do to make sure that you are always in CCPA compliance is to fully understand everything that CCPA entails. This will help to make sure that you and your employees do not violate the rights protected by the CCPA and avoid a legal scandal.
Make sure that you and your employees know and understand the rights that Californians have under the CCPA. You should also know what is required of businesses to make sure that consumer rights aren’t violated.
This also means that you should familiarize yourself with the exceptions to the rules. If you find yourself in a bind trying to uphold CCPA compliance, an exception may release you.
You and all of your employees should understand that a consumer can sue for damages in the event that their personal information is breached. This could be the result of a security issue or a request that is not complied with.
All Day, Every Day
Keep in mind that the CCPA is ALWAYS in effect. The only exception to this is if complying with the CCPA violates federal, state, or local laws.
You aren’t the only one that needs to understand this law backward and forwards. If you want to be sure that you are in compliance, train your employees. Make sure that they know the procedures that have to be followed, and that they are provided with any and all updates made to the law.
It is also important to inform them if these procedures and regulations are only applied to Californians. Whether or not you choose to apply these regulations to only Californians or all consumers is up to the company’s discretion.
What Does The CCPA Not Do?
There are two big things to remember when trying to discern what the CCPA does and does not require of you.
- For people over the age of 16, you are NOT required to obtain consent for the collection and processing of their personal information. This does not mean that you can abstain from providing them the means to opt-out or request the deletion of their personal information.
- You do NOT need to obtain consent to sell personal information, but you do need to have the “opt-out” option linked on your homepage.
Make Data Mapping A Part Of Your CCPA Compliance Project
One thing that you can do to stay fully aware of everything regarding the personal information of users is data mapping.
What Is Data Mapping?
Data mapping is a process used in data warehousing by which different data models are linked to each other using a defined set of methods to characterize the data in a specific definition.—Techopedia
Data mapping will help you determine the what, why, and where of a user’s personal information. You will have thorough data on the types of information collected, why it was collected, and where it is.
You may also want to request that any third-party vendors do this as well if they have access to and/or possess any consumer’s personal information. This will help you cover all of your bases when it comes to handling consumer’s personal information.
FURTHER READING: Web Design Standards: Guidelines for Consistency
CCPA is expected to come into effect at the beginning of 2020 and companies will be expected to be in compliance come the middle of the year.
However, updates may be made to the law. In fact, several have already been made since the writing of the law! So you will want to keep yourself and your employees informed.
As long as you familiarize yourself with the rights protected by CCPA and what is required of you, you should be in a good place to prepare to be CCPA compliant.