CCPA takes effect in January: what marketers must change

CCPA applies to for-profit businesses that collect personal information from California residents and meet any one of three thresholds: annual gross revenue above $25 million; buying, receiving, selling or sharing the personal information of 50,000 or more consumers, households or devices per year; or deriving 50 percent or more of revenue from selling personal information.

The second threshold is the one that catches ordinary businesses. Personal information includes identifiers such as IP addresses and cookie IDs, and the count is of devices as well as people. A site with a few thousand California visitors a month crosses 50,000 devices in a year without trying. If you run advertising pixels, you are collecting that data whether you ever look at it or not.

The Attorney General published draft regulations in October and will not begin enforcement until July 1, 2020, but the rights themselves apply from January 1, and the 12-month look-back means data collected during 2019 is already in scope for access requests.

Right to know. A consumer can ask what categories and specific pieces of personal information you collected, where it came from, why, and who you shared it with over the past 12 months. You have 45 days to respond, extendable once.

Right to delete. A consumer can ask you to delete their personal information, with exceptions for completing transactions, security, legal obligations and a few others. Deletion must reach your service providers too.

Right to opt out of sale. The definition of sale is broad: disclosing personal information to a third party for money or other valuable consideration. Most privacy counsel in 2019 read behavioral advertising data flows as a sale. You must provide a clear link titled "Do Not Sell My Personal Information" on the homepage and in the privacy policy, and you may not ask the consumer to create an account to use it. Minors under 16 require opt-in.

Right to non-discrimination. You cannot charge a different price or degrade service because someone exercised a right. Loyalty programs and financial incentives are allowed if the difference is reasonably related to the value of the data and the consumer opts in.

Work the steps in order. Each depends on the one before.

1. Inventory the data (week 1 to 2). List every system that holds or receives personal information: analytics, tag manager, advertising pixels, email platform, CRM, commerce, support desk, chat, call recording, data vendors. For each, record what it collects, why, how long it is kept and which third parties receive it. This document is the foundation of the privacy notice and the only way to answer an access request in 45 days.
2. Classify vendors (week 2 to 3). Each recipient is a service provider, bound by contract to use the data only on your behalf, or a third party. Transfers to service providers are not sales. Get the written terms in place; most major platforms have published CCPA addenda, and your tag manager list is the place to start.
3. Rewrite the privacy notice (week 3 to 4). It must list the categories collected, the purposes, the categories of sources and recipients, whether you sell, and how to exercise each right, with at least two request methods including a toll-free number unless you operate exclusively online. Date it and plan to update it annually.
4. Build the opt-out (week 4 to 6). Add the link in the footer and the policy. Behind it, a page that records the choice and suppresses advertising tags for that visitor. This is a tag manager and consent-management job; several vendors ship CCPA templates, and the IAB is finalizing a framework for signaling opt-outs to ad-tech partners. Honor the choice for at least 12 months before asking again.
5. Stand up the request process (week 5 to 7). A web form and a phone number, a method to verify identity proportional to the sensitivity of the data, a workflow that searches every system in the inventory, and a log. Train whoever handles support, because requests will arrive by email and chat regardless of what the form says.
6. Train and document (week 7 to 8). Everyone who handles consumer inquiries must know the rights and the process. Keep records of requests and responses for 24 months.

The notice at collection is widely missed. Any form, pixel or app that collects personal information needs a link to the relevant notice at or before the moment of collection, not just a privacy policy buried in the footer.

Treating GDPR work as finished work. If you built a consent banner last year, you have a head start, but CCPA is opt-out rather than opt-in, defines sale rather than processing, and demands a specific link with specific words. The banner may need to change, and the request workflow almost certainly does.

Assuming pixels are not a sale. Some vendors argue it; few lawyers will put it in writing. Build for the conservative reading and you will not have to rebuild in July.

Deleting only from the CRM. A deletion request that leaves the person in the email tool, the ad platform audience and the support desk is not fulfilled.

Ignoring the look-back. The 12-month window reaches into 2019. Start retention housekeeping now; data you no longer hold is data you cannot be asked about.

Letting legal own all of it. Counsel writes the policy. Marketing and technology make it true.

We treat privacy compliance as part of the digital infrastructure a business runs on, connecting the legal requirement to the website, the stack and the campaigns. Discover: we build the data inventory across every system and tag, and map each flow to a CCPA category. Plan: we classify vendors, define the request workflow and decide the consent approach that fits your advertising needs. Build: we implement the opt-out mechanism in the tag manager, the notice at collection on forms, the request intake and the system-by-system fulfilment steps. Improve: we test requests end to end, review quarterly as the regulations settle, and keep the inventory current as tools change. Brand, growth, web and technology stay joined so compliance does not quietly break your measurement.

A representative engagement is described in our e-commerce work, where a store with a large US customer base and a full advertising stack needed privacy handling built into its tag management, email automation and customer service flows without losing the ability to retarget and report. The durable outcome was a documented data map and a request process the team could run without outside help.