A Report on Businesses’ Implementation of the California Consumer Privacy Act in the First Month

California's landmark Consumer Privacy Act (CCPA) went into effect on January 1, 2020. A first-of-its-kind law in the United States, the CCPA grants California residents unique transparency into how covered businesses collect, use, and share consumers' online and offline personal information, and rights to access, delete, and object to the sale of their information.

Although the law passed in June 2018, businesses had to wait most of 2019 to see what the law would look like when it went into effect. Only in October 2019 did the Governor sign a series of amendments to add, inter alia, one-year partial exemptions for the personal information of employees and business-to-business situations. Just days later, the California Attorney General released draft regulations which significantly added to businesses’ notice and recordkeeping obligations. On February 7, 2020, the Attorney General released a modified draft of the regulations. A final version of the regulations is still at least several weeks away.

Notwithstanding the lack of final guidance, the Attorney General begins enforcement of CCPA on July 1, 2020. In the meantime, businesses must balance the cost and resources of implementing the draft regulations, with the risk it could all be for naught if provisions are removed from the final requirements. Added to that uncertainty is a general lack of clarity around analytics and digital advertising technologies such as cookies and pixels, and particularly whether a company’s ordinary use of those technologies on its website amounts to a "sale" of personal information under the CCPA. Two weeks after the law took effect, Holland & Knight conducted a survey of the websites of 125 of the country’s largest public and privately-held companies to take stock of how businesses have operationalized CCPA.

The survey observed substantial differences in the approaches taken by companies, particularly in four key areas:

• Scope of Implementation
• Consumer Requests
• Do Not Sell
• Privacy Policy Updates

READ: A Report on Businesses’ Implementation of the California Consumer Privacy Act in the First Month