The CCPA, which is intended to protect the privacy rights of consumers within the State of California, may require your business to make significant changes to your data privacy and collection practices.
Read on to find out whether or not the California Consumer Privacy Act may impact your startup and learn what you can do to ensure that your business is in compliance with the CCPA.
What Does the California Consumer Privacy Act (CCPA) Do?
The CCPA was designed to make businesses in California more transparent in how they collect and use consumer data. The Act requires qualifying businesses to implement policies and procedures to protect the personal information of their consumers.
Under the CCPA, businesses must disclose the categories of personal information that they will collect at or before the point of collection of consumer data.
Is Your Startup Subject to the California Consumer Privacy Act?
Your business must meet the following criteria to fall within the scope of the California Consumer Privacy Act:
- The annual revenue is at least $25 million;
- Your business buys, sells, or discloses the personal information of over 50,000 California residents, households, or devices in the state within the same year; and
- Your business makes at least 50% of your annual revenue from selling the personal information of your California-based consumers.
As long as your business buys, sells, or collects the personal information of California residents, you may be subject to the CCPA regardless of where your company is located or headquartered.
Note: Beginning in 2023, the CCPA will also apply to startups and other companies that make at least 50% from selling or sharing the personal information of Californians.
A California Startup’s Guide to CCPA Compliance
If your startup is located in California or serves California residents, you will need to organize your consumer data using the following 11 categories of “personal information” under Cal. Civ. Code § 1798.140:
- Identifiers
- Information about protected characteristics
- Any information that falls under the description of “personal information” according to Civ. Code § 1798.80:
- Geolocation information
- Biometric information
- Commercial information
- Internet-related information, including search history
- Audio, visual, electronic, olfactory, or thermal information
- Education information that is not available to the public
- Employment information
- Any information used for profiling
When collecting personal information from consumers, the California Consumer Privacy Act requires startups and businesses to inform the consumer of:
- The category of the personal information that is being collected; and
- The purpose for collecting or selling the consumer’s information.
Under the CCPA, businesses must provide information related to consumer rights and the company’s use of data. This information must be listed in the Privacy Policy or elsewhere on the company’s website.
When preparing the list, you must state whether your company has collected, sold, or disclosed any personal information of consumers in the past 12 months. The CCPA requires you to update the list once every year.
For a detailed explanation of the CCPA compliance requirements, contact our California Startup Attorneys at Structure Law Group. We guide startups in California in navigating applicable state laws and provide high-quality business and marketing services. Call (408) 441-7500 or visit our contact us page for a case review.