What does the new consumer privacy rights act in CA mean for digital marketing?
On November 3, California voters passed Proposition 24 (California Privacy Rights Act – CPRA) to expand consumer privacy protections. It builds on the California Consumer Privacy Act (CCPA) from 2018 to make California law similar to the European Union (GDPR). It will allow consumers to stop businesses from selling or sharing their personal information (like race, religion, geographic location, and sexual orientation). One of the biggest changes is expand protection from “selling” to “selling or sharing” which includes sharing information with agencies and media companies. It imposes greater fines on companies that break these rules and also creates a new agency that will help enforce these laws.
Some additional details that advertisers should be aware of include:
-Making advertisers get permission before collecting data from consumers who are younger than 16 or from a parent or guardian before collecting data from consumers who are younger than 13
-Providing consumers with an “opt-out” option for having their personal information used for advertising or marketing
-Preventing advertisers from sharing a consumer’s personal information upon the consumer’s request and mandating advertisers correct inaccurate personal information upon request
-Establishing new guidelines for “opt-out” links
-Limiting use of certain “sensitive personal information,” like precise location, race, religion, sexual orientation, social security information, specified health information and other categories of personal information
-Setting time limits for retention of personal information
-Increasing penalties for violations in certain situations
-Removing the ability of businesses to fix violations before penalization
The CPRA applies to businesses that:
-Have gross annual revenue of over $25 million.
-Buy, receive, or sell the personal information of 100,000 or more California residents, households, or devices or that derive 50% or more of their annual revenue from selling or sharing California residents’ personal information.
The CPRA will begin in 2023, so there is time to prepare. Some things that advertisers can do include:
-Make sure you have a clear way for consumers to “opt out” of the sharing of their information (like a “pop up” notice on your site informing visitors of your privacy policy including CPRA guidelines and noting consumers’ right to “opt out” with instructions)
-Make sure your partners have strong privacy policies and comply with CPRA
-Monitor and adjust to new policies and targeting changes from Facebook, Google and other media companies. The CRPA will block companies like Fthis from collecting advertising data without consent. This may force them to change their business models or cut into revenue. In a Biden administration, advertisers should expect to see these same privacy guidelines expand nationwide.