Greg WatkinsThe California Consumer Privacy Act of 2018, which goes into effect in 2020, affects businesses doing business in California that satisfy one of the following thresholds: (a) has annual gross revenues in excess of $25 million; (b) annually buys, receives, sells or shares the personal information of 50,000 or more consumers; or (c) derives 50% or more of its annual revenues from selling consumers’ personal information. However, businesses are exempt from the act if every aspect of their commercial conduct takes place outside of California.

The act requires businesses to inform consumers of the personal information being collected and the purposes for which that information will be used. “Consumers” are defined under the act as California residents. The act’s definition of “personal information” is broad and includes information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked to a particular consumer or household.

The act gives consumers the right to request the following from a business:

  • The categories of personal information that the business collected about the consumer
  • The categories of personal information that the business sold about the consumer
  • The categories of third parties to whom the personal information was sold
  • The categories of personal information that the business disclosed about the consumer for a business purpose

The act also contains an “opt-out” mechanism where a consumer may direct a business not to sell the consumer’s personal information. Business must inform consumers of this opt-out right. The consent mechanisms of the act vary greatly from those in the European Union’s General Data Protection Regulation (GDPR). The GDPR prohibits the collecting, processing or transferring of personal information without a legal basis, one of which is a consumer’s informed and unambiguous consent. In other words, consumers are required to “opt-in.”

Businesses located in and out of California should consult with counsel to determine if they will be subject to the act.

Greg Watkins is an attorney at Walter | Haverfield who focuses his practice on corporate transactions and blockchain technology. He can be reached at 216-928-2917 or at