California Consumer Privacy Act (CCPA)

What you need to know about the CCPA and how Constant Contact helps you comply

While we cannot provide legal advice, we thought it would be helpful to provide you with the basics of the California Consumer Privacy Act to help you better understand the law and how it may apply to your business. This information is provided as a convenience — it is not an exhaustive summary and you should consult your own legal counsel to determine if you are affected and for a full understanding of your obligations under the law.

• What is the CCPA?
• What is considered personal information?
• Who does this law apply to?
• What rights does the CCPA provide consumers?
• What do I need to do to be compliant with the CCPA?
• How is Constant Contact helping me comply with the CCPA?
• I’m a customer from California - how can I learn more?
• How can I access, correct, or export my consumers’ data?
• What if I have additional questions?

What is the CCPA?

The CCPA, which is short for the California Consumer Privacy Act, is a law designed to enhance consumer privacy rights for California consumers and to encourage transparency regarding how businesses collect and use personal information. Businesses subject to the CCPA are expected to be in compliance with the law by January 1, 2020.

What is considered personal information?

The CCPA defines personal information as “information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.” In short, if information can be traced back to, or is related in some way to, a consumer or household, it is likely to be considered personal information under the CCPA.

In addition to an individual’s name, address, email address, financial information, contact information, and identification numbers, personal information can include details related to an individual’s digital life, like an IP address, geolocation, browsing history, cookies, or other digital identifiers. It could also include information about an individual’s physical, mental, social, economic, or cultural identities. The CCPA’s definition of personal information also extends to personal information relating to a household, even if it does not identify a specific individual within that household.

Who does this law apply to?

The CCPA applies to businesses that are doing business in California if they meet the following conditions:

• Are for profit (generally speaking, non-profit organizations do not have to comply with the CCPA unless they share branding or are controlled or owned by a for-profit organization); 
• Collect and control the processing of California consumers' personal information;
• Do business in California, or target California consumers; and
• Meet any one of the following conditions:
  • Have annual gross revenue in excess of $25 million,
  • Annually receive, buy, sell, or share personal information of 50,000 or more consumers or households within California, or
  • Derive fifty percent or more of their annual revenue from selling personal information.

What rights does the CCPA provide consumers?

The CCPA was passed by California lawmakers to give California consumers more control over their personal information (described above). The law defines a “consumer” as a natural person who is a resident of California and it also applies to California residents who are traveling outside of the state. The CCPA is designed to ensure that consumers have:

• the right to be informed about what personal information is being collected about them, where it was sourced from, what it is being used for, and whether their personal information is sold or disclosed;
• the ability to opt out of the sale of their personal information, request access to their personal information, request deletion of their personal information; and  
• protection against discrimination for exercising any of these rights.

Please note that not all of these rights listed above are absolute, and limitations and exceptions may apply in some cases. Businesses are required to provide a method to receive and respond to individual rights requests submitted by California consumers.

What do I need to do to be compliant with the CCPA?

As mentioned above, under the CCPA, consumers can request that businesses do not sell their personal information. The definition of “selling” under the CCPA is very broad and includes “selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to another business or a third party for monetary or other valuable consideration.”

If you “sell” personal information as defined by the CCPA, you are required to provide a link that says “Do Not Sell My Personal Information” or “Do Not Sell My Info” on your website’s homepage and within your privacy notice. If a consumer opts out, you must honor their request and communicate it to third parties with whom you share the consumer’s information. To ensure that you are able to honor these “Do Not Sell” requests, it is important for you to understand how you collect and share personal information in all contexts.

Businesses are required to notify consumers of their rights under the CCPA, including their right to deletion, right to know, and data portability rights as well as how to exercise these rights. These required disclosures can either be made via a privacy policy, in a CCPA-specific notice, or at the time the business collects the personal data. Before the CCPA goes into effect, you should make sure that your privacy notice accurately reflects your information sharing and business practices.

Businesses must also implement processes to respond to verified consumer requests and opt-out requests. Businesses must make at least two methods for submitting requests available to consumers including, at a minimum, a toll-free telephone number and a website address if the business maintains one. Businesses are also required to respond to consumers’ requests within the time limits set out in the CCPA.

You should consult the CCPA and the proposed regulations to gain a full understanding of these requirements. You can also check out these resources to understand how you must disclose Constant Contact’s privacy practices to your contacts in your privacy notice: Constant Contact Privacy Practices; Host a Privacy Policy for Your Organization; and Frequently Asked Questions.

How is Constant Contact helping me comply with the CCPA?

Constant Contact is dedicated to ensuring that our products allow our customers to comply with their obligations under the CCPA. Where required, we will support you in fulfilling CCPA-related requests that you receive from your contacts.

I’m a customer from California - how can I learn more?

If you are a California consumer and exercise your CCPA rights as a Constant Contact customer, Constant Contact will respond in accordance with our Privacy Notice.

The Constant Contact Privacy Center explains what information we collect about you as a Constant Contact customer and how we handle your personal information. This notice includes descriptions of how your personal information is used by Constant Contact.

How can I access, correct, or export my consumers’ data?

You can view and update a contact’s information on the contact profile page within your Constant Contact account.

Your contacts can also access and update their information and their marketing preferences by clicking the Update Profile link in the footer of each email you send to them through Constant Contact. By default, the Update Profile form only shows a contact’s email address. If you are storing more information about contacts, you can display those fields to your contacts by customizing the Update Profile form.

What if I have additional questions?

If you have specific questions about the assistance we can offer with the CCPA, please contact Support or email privacy@constantcontact.com.

Questions?