12/20/2019 -- California’s Consumer Privacy Act of 2018 will become effective on January 1, 2020, which creates significant new consumer protections and privacy requirements for how businesses handle the consumer’s personal information.  The California Attorney General, who is charged with enforcing the new law, has proposed regulations that would implement it.  Under the new law, a business will be subject to this new law if one or more of the following circumstances apply:

  • It has gross annual revenues in excess of $25 million
  • It buys, receives, or sells the personal information of 50,000 or more consumers, households, or devices
  • It derives 50% or more of annual revenues from selling consumers’ personal information
  • The new law impacts both businesses located in California and businesses that handle the personal information of consumers who live in California

The new law will grant consumers a right to request a business to disclose the categories and types of personal information that it collects about them, how it is obtained, the business reason for collecting and selling it, and the categories of third parties with which the information is shared.  Under this new law, consumers have the right to opt out of a business selling their personal information and have the right to request that the business delete their information.  The new law prohibits businesses from discriminating against the consumer for exercising their right to opt out of their information being sold, except in certain circumstances.  Businesses will be allowed to offer financial incentives for collecting a consumer’s personal information.

The new law creates several consumer notice requirements for businesses to meet concerning the handling of the consumer’s personal information.  There are additional requirements for handling a minor’s personal information.  The new law provides a private right of action for consumers in the event their personal information is handled in a manner that violates the new law.  The new law also provides that waivers of a consumer’s rights under the new law in a contract or agreement are void and unenforceable.

The proposed regulations set forth detailed content requirements for the notices that businesses must provide to consumers, the requirements for a consumer data privacy policy, procedures for the submission and handling of consumer requests concerning their personal information, and verification of a consumer’s identity.  The comment period recently closed for the proposed regulations, but they have yet to be finalized.

Click here for a detailed fact sheet, as well as a copy of the legislation and the proposed regulations.