Inspired by California’s CCPA, more states are debating whether to follow suit. The California Consumer Privacy Act (CCPA) is a bill signed into law in late 2019 to protect California residents from having their personal data shared or sold to third parties without consent. This law went into effect on the first of the year.

The CCPA follows quick on the heels of the General Data Protection Regulation (GDPR) in Europe, which took effect in 2018. The key tenants of the law are very similar, essentially barring organizations from collecting or storing personal data without the consumer’s consent. As a result, nearly every website now informs users that some sort of digital fingerprint is being recorded.

So what is my “data” and why is that important? Personal data is defined by the state of California as “information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.” The use of your personal data by companies is important because it can determine how an organization will market directly to you, even if you don’t want them to. Think of all those robocalls and junk emails you get that you don’t remember opting into. That is likely the result of a company that you did share your info with, selling that data to another company that also wants to market to you.  

One of the biggest points of the CCPA is that consumers have the right to access the data being collected on them, the right to ask an organization to delete their data, and the right to not have their data shared with anyone unless they personally opt-in. Enforcing this new law will be challenging as nearly 90% of American companies are not yet in compliance. Consequences for failing to adhere to the new law include steep, even financially devastating fines regulated by the FEC.

Currently the law only protects California residents, but it’s expected that other states will quickly adopt the law too. Since California has one of the highest populations of any US states, the CCPA is important for any organization targeting California residents for marketing or commerce. Data breaches continue to erode consumer trust and the CCPA is the first measure taken by a US state to hold companies legally liable for any mishandling. Expect states like Massachusetts, Minnesota, Pennsylvania, New Jersey, and New York to follow.

Additional Resources:

https://oag.ca.gov/privacy/ccpa

https://www.consumerreports.org/privacy/california-privacy-law-ccpa-california-consumer-privacy-act/

https://iapp.org/resources/article/california-consumer-privacy-act-of-2018/