How To Make Your website CCPA Compliant in less than 1 week

CCPA stands for California Consumers Protection Act 2018. It is the most recent cookie law passed by the State of California as a response to the increased role of personal data in contemporary business practices and the personal privacy implications surrounding the collection, use, and protection of personal information.

The California government set the precedent among states in the US in passing laws aimed at protecting consumer privacy.

California Consumer Protection Act (CCPA) is not a replacement for any existing California data protection law. All of them are expected to be in effect after 1 January 2020; therefore, you’ll have to comply with every data protection regulation adopted in the state. CCPA was meant to complement the current personal data protection, not to replace it. CalOPPA and other personal data protection laws will continue to exist, which means the obligations to meet the stipulated requirements for your business still remain. Introducing the CCPA doesn’t change anything regarding your duties to comply with other California privacy laws, such as the CalOPPA, Shine the Light, and the Privacy Rights for California Minors in the Digital World Act.

The California Consumer Privacy Act (CCPA) applies to every company in the world if:

1. They collect personal data of California residents
2. They (or their parent company or a subsidiary) exceed at least one of the three thresholds

• Annual gross revenues of at least $25 million
• Obtains personal information of at least 50,000 California residents, households, and /or devices per year
• At least 50% of their annual revenue is generated from selling California residents’ personal data

A California resident is defined by California’s Privacy law as any person who:

•   Is in California for other than a temporary or transitory purpose
•   Is domiciled in California, but is outside the state for temporary or transitory purposes

It doesn’t matter how small or big your business is. California’s new privacy law is not focused on the size of your business, but whether it meets certain criteria as mentioned above.

Failure to comply with CCPA puts you at risk of huge fines. You can expect the Attorney General to initiate a civil case against you if you do not meet CCPA requirements after 30 days upon being notified about it. This brings a risk of being fined up to $7500 per violation in case of a data breach.

It means that if you violate the CCPA-guaranteed rights of 1000 users, you might receive a fine of up to $7.500.000 in total ($7500×1000 users).

No, it is not. The government of California may have used the momentum created by the introduction of EU’s General Data  Protection Regulation (GDPR) to augment the ePrivacy Directive, but the CCPA requirements are not as extensive as the GDPR cookie consent obligations. The GDPR shares similarities with other data privacy laws introduced recently, but they have substantial differences.

These differences include the entities they cover, information required in privacy policies, prior consent, and sales of personal information. For more information read this article.

CCPA contains clear and precise compliance requirements that your business needs to meet in case this law applies to you. Therefore, compliance with CCPA requires:

• Updating your privacy policy with information on how, why and what personal information you collect and process.
• Updating your privacy policy with information on how your users can request access, change, or erasure of their personal data that you have collected.
• Introducing a method for verification of the identity of the person making such requests.
• Introducing a “Do Not Sell My Personal Information” link on your home page. It will serve your users to prohibit the selling of their personal data from your side.
• Obtaining prior consent from minors 13-16 years old before selling their personal data. For minors younger than 13 you have to obtain prior consent by their parents.

CCPA affects your website if you collect and process data of California residents and exceed at least one of the following thresholds:

• Annual gross revenues of at least $25 million
• Obtains personal information of at least 50,000 California residents, households, and /or devices per year
• At least 50% of your annual revenue is generated from the sales of California residents’ personal data

Anyone can visit your website, including California consumers. Therefore, if you exceed or may soon exceed any of the thresholds listed above and you use any type of tracking tool, it is better to be CCPA compliant.

Data map, or data inventory, is a process of figuring out what type of information you collect, why you do it, where it is held, with whom it is shared, how it is transferred, and other questions related to the data collection and use you conduct regularly.

CCPA requirements mean that you need to conduct a data mapping of your California consumers. It is not clearly required by the California Consumer Privacy Act, but it is a good practice that minimizes the risks associated with users’ data.

A privacy policy is a document that explains what you do with users’ data. It may also provide them with information on their consumer privacy rights.

CCPA requires being transparent about your data-usage practices, which is best done through your privacy policy. To ensure it is CCPA compliant, you need to update it by adding the following:

•     What kind of information you collect and process
•     Why do you collect and process information
•     How do you collect and process information
•     The methods to request access, change, move, or deletion of their personal data
•     The method for verifying the identity of the person who submits a request
•     Sales of users’ personal data and how they can opt-out of the selling of their data

This will ensure compliance with CCPA, but feel free to go a step further with transparency if you want to. Just don’t go below the required minimum.

CCPA requires obtaining prior cookie consent from minors before selling their personal information. If they are 13-16 years old, you have to obtain it from them. If they are younger, it is necessary to obtain it from their parents or guardians.

You may ask for consent whenever a minor California resident comes to your website and keep it, or ask for it right before selling their personal data. However, do not sell their data without their consent. It is a breach of their consumer privacy rights and you’ll be fined.

For effective consent management, ensure that you keep each and every CCPA cookie consent obtained from minors and their parents. It is a good practice to keep documentation of everyone who has given or rejected consent for the placement of different types of cookies.

Secure Privacy offers an automated and integrated solution to your website:

1. 'Do not sell' for websites: Opt-out from advertisement and other tracking plugins using our web widget
2. 'Do not sell' for other systems: A CCPA form from which users can select what data they wish to opt-out from. This can be data in e.g. your SalesForce system.

Yes, we CCPA readiness tests, webite audits, training and more. Please write us at hello at secureprivacy.ai about your inquiries.

Yes, we offer full support for GDPR among other data privacy laws.

Yes, we offer volume discounts. Please contact us at hello at secureprivacy.ai

Yes, you can. We offer a FREE trial. You can cancel anytime. See our pricing here.

You sure can. Go to your administration panel at any time, and you will find cancel in the account section.