Jan 10, 2020

Do you need to worry about the California Consumer Privacy Act?

Highlights:

• California’s Consumer Privacy Act went into effect Jan. 1, 2020
• Intended to give consumers more control over the use personal information
• Impacts businesses in California depending on gross revenues or collection of personal data

The California Consumer Privacy Act went into effect Jan. 1, 2020, resulting in many websites suddenly including a disclosure on tracking consumer activity for advertising purposes. In the midst of significant changes regarding consumer privacy and data security, insurance producers in across the country may wonder if this law applies to them. As many PIA members have experienced, a state law can extend far outside the state’s borders and even to producers who do not have a nonresident license for that state.

Businesses with a presence in California may need to comply if they meet one of three possible thresholds. The statute applies only to entities that do business in California with more than $25 million dollars annual gross revenues; buy, receive, or sell the personal information of 50,000 or more consumers, households, or devices for commercial purposes; or derive 50% or more of its annual revenue from selling consumers’ personal information. Commercial clients may need to comply with the CCPA if they meet one of those thresholds and do business in California. The CCPA applies to all business entities, regardless of the nature of the business.

The CCPA is designed to improve consumer privacy and gives consumers greater insight and control over how their personal information is shared.  Entities required to comply with the CCPA must disclose the specific pieces of personal information they collected, the purpose for collecting such information, and how that information is used.  To give consumers more control over their information, the law allows them to request that their personal information is not shared with third parties. Many websites funded by advertising sales now include disclosures on the tracking of data and provide visitors the opportunity to opt-out of the sale of their data. California has provided limited information on how the state will enforce the CCPA.