Frequently asked questions about the California Consumer Privacy Act (CCPA)

The California Consumer Privacy Act of 2018, CCPA in short, is California’s new privacy law that grants California residents with new rights with respect to their personal information. It will go into effect on January 1, 2020, and is consequently top of mind for many businesses, especially for those that engage in online advertising.

Similar to GDPR, this new regulation requires that all companies collecting, accessing, and processing personal data for California residents must comply with new standards, that while similar to GDPR, introduce some new nuances.

To help address any common CCPA questions you may have, we’ve compiled the top FAQs for the CCPA. Please note that this document is not intended to be a comprehensive analysis of CCPA or guidance on whether it may apply to specific clients. We recommend that you reach out to your internal legal advisors to determine how CCPA may impact your business.

General CCPA FAQs

1. Is Singular a CCPA compliant service provider?

Yes — Singular complies entirely with the CCPA regulation. We can exercise any request received by our customers to provide or delete data, and our built-in mechanisms for managing consents easily allow compliance with Opt-out requests.

Built by security experts, Singular has always been security and privacy driven by design. We treat encryption, security, and privacy as core principles that determine how every new system is defined and built, and these are inherently embedded in the platform.

2. When is the CCPA coming into effect?

Jan 1st, 2020.

3. Who does the CCPA affect?

It applies to all companies processing and holding the personal data of California residents, also known in the regulation as California Consumers, regardless of the company’s location, and meets one or more of the following thresholds:

  • Has an annual gross revenue in excess of $25 million;
  • Annually buys, receives for commercial purposes, sells, or shares the personal information of 50,000 or more California consumers, households or devices; or
  • Derives 50% or more of its annual revenue from selling California consumers’ personal information

4. What are the key principles? 

The CCPA provides consumers with the following rights regarding their collected information:

  • The right to access data – Consumers may request a copy of the specific personal information collected about them in a readily useable format.
  • The right to know – Consumers have the right to know the categories of personal information a business has collected about them, from what sources information was collected, for what purposes the information was collected and used, as well as know about their data being sold or disclosed to a third party for any reason.
  • The right to delete – Consumers can request the deletion of their personal information collected by a business.
  • The right to opt-out – Consumers must be able to opt-out of the sale of their personal information.
  • The right to not be discriminated against for exercising CCPA rights – Consumers have the right not to be discriminated against when exercising any of the above rights.

5. What are the penalties for non-compliance?

The California Attorney General will first provide a business with 30 days’ notice to cure any noncompliance with the CCPA. If the business remains noncompliant after 30 days, it may be subject to fines. Violations of the CCPA are subject to a civil penalty not to exceed $2,500 per violation; intentional violations of the CCPA are liable for a civil penalty of up to $7,500 per violation.

6. What is the difference between a service provider and a business?

A service provider will handle the data it receives in relation to a particular customer, only to serve that particular customer and for no other secondary business purposes, neither for itself nor for any other customer, and for no purpose outside of the business relationship with the customer. On the other hand, a business may use the data it receives (however it receives it) for a business purpose.

7. Opt-in vs. opt-out?

This is presumably the biggest difference between GDPR and CCPA. While GDPR required all personal data processing to be “Opt-In”, CCPA talks about consumers and their rights to opt-out. Furthermore, there is CCPA specific language around Opt-Out applying only in cases of a business selling data, so the notion of Consent is quite different between GDPR and CCPA.

8. What about users under the age of 16?

For children under the age of 16, CCPA requires an explicit Opt-In, referred to as “Right to Opt-In” by the regulation. For children under the age of 13, a parent or guardian must affirmatively authorize the sale of information.

9. I’m not using Singular for attribution or event tracking. Does CCPA apply here?

If Singular doesn’t collect personal (user level) data for your users, it is not technically a Service Provider in the CCPA context.

10. Do you have an updated California Data Privacy Addendum I can sign?

Yes, please reach out to your Customer Success Manager to get our latest addendum created for CCPA.

11. What else is Singular doing around the CCPA?

Built by security experts, Singular has always been security and privacy driven by design. We treat encryption, security, and privacy as core principles that determine how every new system is defined and built, and these are inherently embedded in the platform.

We took great pride in preparing for GDPR which equipped our customers with easy to use interfaces, supporting both server-side and client-side requests. We are also pioneering a Mobile Attribution Privacy group called MAP, in close collaboration with leading ad networks and attribution providers, to further ensure privacy is constantly addressed as a first priority in the attribution space.

 

Looking for more information or have questions? Contact us at privacy@singular.net or dpo@singular.net

Disclaimer: The information provided by Singular is for informational purposes only and not for the purpose of providing legal advice. Please contact your attorney to obtain advice on specific issues or questions.