Legislative Updates, Privacy

Update on California Consumer Privacy Act

By Bret Buckler and Todd Taylor
Recently the state of California passed a data privacy and security law called the California Consumer Privacy Act (“CCPA”) (Assembly Bill 375, found here).

The law, which takes effect on January 1, 2020, is aimed at establishing a defined set of rights for consumers with regard to how their personal information is being collected and used.  The political push for the law comes on the heels of a contentious few months where tech giants such as Facebook have admitted to potentially problematic data breaches and oversharing of personal information, causing a groundswell of concern over the accountability of businesses in terms how they process, store, monetize, and share personal information. 

Some notable consumer rights under the CCPA include:

  • A consumer has a right to request that a business disclose categories and specific pieces of personal information that the business has collected concerning the consumer, and must provide information if their collection practices change.
  • After receiving a verifiable consumer request for such information, the business must provide such information to the consumer free of charge.
  • A consumer has a right to request that a business delete any personal information about the consumer which the business has collected from the consumer.
  • If a business sells consumers’ personal information to third parties, a consumer has the right, at any time, to stop the sale of their information (the right to “opt-out”).
  • Consumers ages 16 and under are required to “opt-in” or affirmatively authorize the sale of their personal information before the business can make use of it in this way. Ages 13-16 may opt-in themselves, while those under 13 require a parent or guardian to opt-in on their behalf. 
  • Consumers have a right to know categories of third parties with whom businesses are sharing their personal data. The business must provide a list of categories as set out in the CCPA.
  • Consumers have a right to know the categories of sources of information from who personal data was acquired. The business must provide a list of categories as set out in the CCPA.
  • Consumers have a right to know the business or commercial purpose of collecting personal information.
  • The law is enforceable by the Attorney General of California. Consumers have a private right of action when a business breaches personal information. 

The CCPA is currently the most stringent state data privacy and security law of its kind.  As such, it sets a new precedent in the realm of state level data privacy laws.  Critics have used the term “sweeping” when referring to the nature of its broadly defined terms and potentially wide reach.  For instance, the definition of “personal information” under the CCPA includes expected categories of data such as real name, alias, postal address, email addresses, social security number, passport number and the like.  However, the definition also includes “unique identifiers,” which could be Internet Protocol addresses, cookies, beacons, pixel tags, mobile ad identifiers, geolocation data, and other similar data/technology. 

One loophole offered under the CCPA is gaining significant attention from online advertising agencies. Under CCPA § 1798.145, businesses may “[c]ollect, use, retain, sell, or disclose consumer information that is deidentified or in the aggregate consumer information” without any restriction imposed by the CCPA.  For now, it is not entirely clear whether the identifiers most widely used in online advertising space would qualify for this exception.  For instance, it may be possible to de-anonymize certain types of data, or it may be the case that certain seemingly de-identified data is actually tied to a device identifier, which in turn can be used to identify a user of the device and implicate CCPA rights and restrictions.

It’s also important to note that the CCPA does not apply to business that collect or sell consumers’ personal information if “every aspect of that commercial conduct takes place wholly outside of California.”  In order to qualify for this loophole, a business must be able to show: (1) personal information was collected while the consumer was outside of California; (2) no part of the sale of the information occurred in California; and (3) if the consumer was in California, no personal information collected while the consumer was in California has been sold.  This includes information that may have been stored on the user’s device while the consumer was in California and then later retrieved and stored while the consumer was outside of California.


No comments yet.

Leave a comment

Your email address will not be published. Required fields are marked *

Welcome to Data Points!

The technology and regulatory landscape is rapidly changing, thus impacting the manner in which companies across all industries operate, specifically in the ways they collect, use and secure confidential data. Moore & Van Allen’s Privacy & Data Security Group recognizes the challenges clients face in the effort to stay abreast of such volatility. “Data Points” seeks to educate by providing transparent and cutting-edge insight on the most critical issues and dynamics. Our goal is to inform business decision-makers who are navigating these waters about the information they must protect, and what to do if/when security is breached.

Connect To Recent Authors

  • Karin McGinnis:  View Karin McGinnis' Bio View Karin McGinnis' LinkedIn profile
  • Todd Taylor:  View Todd Taylor's Bio View Todd Taylor's LinkedIn profile
  • Brandon Gaskins:  View Brandon Gaskins' Bio View Brandon Gaskins’ LinkedIn profile
  • Robert Sumner:  View Robert Sumner’s Bio
  • Carol Bowen:  View Carol Bowen's Bio View Carol Bowen’s LinkedIn profile

  • Subscribe to Blog via Email

    Follow MVA


    Blog Topics


    Interested In Other Topics?

    Tell us what else you are interested in here.

    Our Privacy & Data Security Practice

    Moore & Van Allen has a Privacy & Data Security practice with the depth and breadth to advise the multitude of business industries and practices impacted, including sales, human resources, data maintenance and storage, IT, legal and compliance, labor and employment, health care, finance, cross-border transactions, energy and litigation. All require careful attention to protecting the privacy of personal information as well as preserving the integrity of company, customer or third party data. To help our clients successfully navigate their data security challenges and manage their risk in these areas, our multi-disciplinary team draws on their deep experience in addressing data privacy and information security obligations and disputes. Read More About Our Practice and Meet the MVA Privacy & Data Security Team.


    No Attorney-Client Relationship Created by Use of this Website: Neither your receipt of information from this website, nor your use of this website to contact Moore & Van Allen or one of its attorneys creates an attorney-client relationship between you and Moore & Van Allen. As a matter of policy, Moore & Van Allen does not accept a new client without first investigating for possible conflicts of interests and obtaining a signed engagement letter. (Moore & Van Allen may, for example, already represent another party involved in your matter.) Accordingly, you should not use this website to provide confidential information about a legal matter of yours to Moore & Van Allen.

    No Legal Advice Intended: This website includes information about legal issues and legal developments. Such materials are for informational purposes only and may not reflect the most current legal developments. These informational materials are not intended, and should not be taken, as legal advice on any particular set of facts or circumstances. You should contact an attorney for advice on specific legal problems. (Read All)