Starting in 2020, California’s Consumer Privacy Act (CCPA) will require businesses to tell consumers what data has been collected about them and, if requested, to delete that data.
Businesses that do work in California must provide consumers with two ways to ask about data collection – an effort that could cost businesses between $55,000 and $2 million.
Businesses must create a simple way for consumers to opt out of having their data sold and will be allowed to charge you more for their services if you opt out.
Businesses must comply with the law if they meet one of the following qualifications:
- They have at least $25 million in annual revenue
- They obtain at least 50% of their revenue from selling user data
- They have access to personal information about more than 50,000 people
The CCPA allows consumers to make requests about data twice per year and to sue companies if their personal data is accessed or stolen during a data breach.
The law, which is being copied in nearly half of states, could permanently change the online economy by decreasing the value of targeted ads.
Millions of companies rely on targeted ads, which require personal information. If users ask companies to delete that information, the ads will be less effective. Big companies like Google could lose massive amounts of revenue if forced to rely on generic ads (which command far lower prices than targeted ads).
Ultimately, the effect of the law will depend on whether people assert the rights provided by it.
“Is this a big deal for thousands or hundreds of thousands or millions of people?” asks Chris May, a risk consultant for Deloitte. “We don’t know yet.”
Analysts predict small and midsize companies will risk the penalty of noncompliance rather than expend the resources required by the law.
“Large businesses have the capacity to figure this out, but it’s an extreme burden for small ones, which are the backbone of this nation’s economy,” says Tim Day, a senior vice president at the US Chamber of Commerce.
California’s Justice Department has until July 1st to figure out how to enforce the law. In the meantime, California’s Chamber of Commerce is lobbying Congress to pass a similar law to preempt the CCPA.
“It’s going to be unworkable to have a balkanized approach to data privacy,” says Dan Jaffe, an executive with the Association of National Advertisers. “But what a national law will look like is up in the air.”
Editor’s note: Any small business that does marketing needs to take a good look at this. Even if you pay others for your marketing, you could easily run afoul of this law and get in trouble.