The 7 Key Steps to Making Websites CCPA Compliant and Future-Proof for CCPA 2.0

CCPA stands for California Consumers Protection Act 2018. It is the most comprehensive data protection regulation in California and the United States.

It has been passed as a response to the GDPR and other data protection laws. It is not as comprehensive as the EU law, yet it grants consumers with more rights about their data privacy than ever.

The California government was the first ever US state to pass a data privacy law. It has been updated multiple times.

Yes, you have to comply with any data protection law that is currently in force in California, and that includes CalOPPA and other laws as well.

The CCPA is not a replacement for any existing California data protection law. All of them are in effect after 1 January 2020; therefore, you’ll have to comply with every data protection regulation adopted in the state.

CCPA was meant to complement the current personal data protection, not to replace it. CalOPPA and other personal data protection laws will keep to exist, which means the requirements for your business remain. Introducing the CCPA doesn’t change anything regarding your duties to comply with other California privacy laws, such as the CalOPPA, Shine the Light, and the Privacy Rights for California Minors in the Digital World Act, as well as federal laws such as HIPAA.

CCPA compliance means that you meet all the compliance requirements as set out in the CCPA.

These requirements have been set by the government to improve the level of personal data protection in California. Meeting some of them is not enough to make your business compliant. You need to meet every single requirement as set out by the law.

The California Consumer Privacy Act (CCPA) applies only to businesses that meet the requirements for applicability.

It applies to every company in the world if:

• They collect personal data of California residents, and
• They (or their parent company or a subsidiary) exceed at least one of the following three thresholds:
  undefinedundefinedundefined

A California resident is defined by California’s Privacy law as any person who:

•   Is in California for other than a temporary or transitory purpose, or
•   Is domiciled in California, but is outside the state for temporary or transitory purposes.

It applies to every business that meets the applicability standards. It doesn’t matter how big the business is. California’s new privacy law is not focused on the size of your business, but whether it meets certain criteria as mentioned above.

If the CCPA applies to your business, then you have to be CCPA compliant.

The requirements you need to meet include:

• A CCPA compliant privacy policy
• Respect of consumer rights to know, to access, to deletion, etc.
• Provide privacy notices to consumers when they arrive on your website or app
• Provide an opportunity to opt-out of the sales of personal information
• Keep records of your privacy practices.

This is not an exhaustive list. The CCPA compliance requirements depend on the circumstances your business operates in and your privacy practices.

CCPA contains clear and precise compliance requirements that your business needs to meet in case this law applies to you. Therefore, compliance with CCPA requires:

• Updating your privacy policy with information on how, why and what personal information you collect and process.
• Updating your privacy policy with information on how your users can request access, change, or erasure of their personal data that you have collected.
• Introducing a method for verification of the identity of the person making such requests.
• Introducing a “Do Not Sell My Personal Information” link on your home page. It will serve your users to prohibit the selling of their personal data from your side.
• Obtaining prior consent from minors 13-16 years old before selling their personal data. For minors younger than 13 you have to obtain prior consent from their parents.

CCPA affects your website if you collect and process data of California residents and exceed at least one of the following thresholds:

• Annual gross revenues of at least $25 million
• Obtains personal information of at least 50,000 California residents, households, and /or devices per year
• At least 50% of your annual revenue is generated from the sales of California residents’ personal data

Anyone can visit your website, including California consumers. Therefore, if you exceed or may soon exceed any of the thresholds listed above and you use any type of tracking tool, it is better to be CCPA compliant.

Data map, or data inventory, is a process of figuring out what type of information you collect, why you do it, where it is held, with whom it is shared, how it is transferred, and other questions related to the data collection and use you conduct regularly.

CCPA requirements mean that you need to conduct a data mapping of your California consumers. It is not explicitly required by the California Consumer Privacy Act, but it is a good practice that minimizes the risks associated with users’ data.

A privacy policy is a document that explains what you do with users’ data. It may also provide them with information on their consumer privacy rights.

CCPA requires being transparent about your data-usage practices, which is best done through your privacy policy. To ensure it is CCPA compliant, you need to update it by adding the following:

• What kind of information you collect and process
• Why do you collect and process information
• How do you collect and process information
• The methods to request access, change, move, or deletion of their data
• The method for verifying the identity of the person who submits a request
• Sales of users’ data and how they can opt-out of the selling of their data

This will ensure compliance with CCPA, but feel free to go a step further with transparency if you want to. Just don’t go below the required minimum.

CCPA requires obtaining prior cookie consent from minors before selling their personal information. If they are 13-16 years old, you have to obtain it from them. If they are younger, it is necessary to obtain it from their parents or guardians.

You may ask for consent whenever a minor California resident comes to your website and keep it, or ask for it right before selling their data. However, do not sell their data without their consent. It is a breach of their consumer privacy rights and you’ll be fined.

For effective consent management, ensure that you keep every CCPA cookie consent obtained from minors and their parents. It is a good practice to keep documentation of everyone who has given or rejected consent for the placement of different types of cookies.

To learn how our cookie blocking works, please see this guide.

Yes, we offer CCPA readiness tests, website audits, training and more. Please schedule a call here.

Yes, we offer full support for a wide range of privacy laws including CCPA and LGPD.

Yes, we offer volume discounts. Please schedule a call here.

Yes, you can. We offer a FREE trial. You can cancel anytime.

You sure can. Go to your administration panel at any time, and you will find cancel in the account section.