California regulates consumer privacy via the California Consumer Privacy Act (CCPA), an expansive legislation reminiscent of the European Union's General Data Protection Regulation (GDPR). CCPA imposes obligations on covered businesses to (1) give consumers notice of what personal data it collects, how the data is used or shared and whether the data is being sold, and (2) set forth the rights that consumers have with respect to the data collected from them.
Notice Applicable to Methods of Collection of Personal
Data
Notably, the CCPA applies not only to online data
collection but also to collection on mobile, offline by use of
forms or exchange of documents, over the phone or in person. Cal.
Code Regs. Tit. 11, § 999.305(a)(3).
A business that collects personal information from a consumer must provide such notice at the time of collection in accordance with the CCPA and the regulations promulgated in accordance with the law. Cal. Code Regs. Tit. 11, § 999.304(b). This means the privacy notice must be made readily available where consumers will encounter it at or before the collection of any of their personal information. If a business collects personal data from a consumer in person but their privacy notice is posted only on the business's website, this will likely not be deemed a sufficient notice at the time of the collection.
Enforcement Actions
Recent enforcement actions issued by the
California Attorney General (CA AG) illustrate this point and
remind businesses of the importance of apprising their consumers of
their privacy policies not only online but also offline.
Specifically, the AG reports that it initiated an enforcement
action against an automotive business that collected information
from consumers test driving vehicles at the business. Although the
business had a written privacy policy, it failed to provide a
notice of it at collection. The CA AG notified the business of
alleged noncompliance, and the business implemented a notice at
collection for personal information received in connection with
test drives, whether collected online or in person.
Examples of Timely Notices
CCPA regulations (Cal. Code Regs. Tit. 11, § 999.305(a)(3))
provide illustrative examples of how a timely notice may be given
to consumers:
- Online collection – A business may post a conspicuous link to the notice on the introductory page of the business's website and on all web pages where personal information is collected.
- Mobile application – A business may provide a link to the notice on the mobile application's download page and within the application, such as through the application's settings menu.
- Offline collection – A business may provide a printed version of the privacy notice or post prominent signage directing consumers to a notice that may be found online.
- Telephone or in-person collection – A business may give its privacy notice verbally.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.