California Consumer Privacy Act (CCPA) - What are you doing to get ready?

I think the big thing here is that systems and products in the future will not revolve around advertisement and the collecting, packaging, and selling of consumer data.

Not to say that there wont be business models like this, but that they will not be the next facebook or google.

Compliance isn't all that difficult if you are not selling users personal data and if you have privacy and security built into your system by default. (for instance, if you have E2E encryption on communications.)

For smaller companies, my understanding is that this isn't going to be enforced as vigorously - and you really don't and shouldn't be worried about it until:

You have over $25 million in annual revenue,
Process information related 50,000 or more California consumers or devices annually, or
Make more than half of your annual revenue from selling consumers’ personal information.

And then compliance is pretty much a 3 step process:

offer a button for poeple to opt-out selling
updating terms of service explaining how data is sold and how to opt out.
having a mechanism for people to submit requests for their data, and getting a response within 45 days, with the option to delete all data.

That requires some development time, and I suppose you could automate it to start with but in reality by the time your numbers are that big it will be an easy fix. You should only truly be worried in a startup if your business model is selling user data.

tldr;
If your a startup and not planning on tracking/selling customer data, don't worry about it until your making 25M a year in revenue or have a shit load of customers from CA. Then google what it is and hire a compliance guy.

Say something nice to isotropix…

4
I think the big thing here is that systems and products in the future will not revolve around advertisement and the collecting, packaging, and selling of consumer data.

Not to say that there wont be business models like this, but that they will not be the next facebook or google.

Compliance isn't all that difficult if you are not selling users personal data and if you have privacy and security built into your system by default. (for instance, if you have E2E encryption on communications.)

For smaller companies, my understanding is that this isn't going to be enforced as vigorously - and you really don't and shouldn't be worried about it until:
1. You have over $25 million in annual revenue,
2. Process information related 50,000 or more California consumers or devices annually, or
3. Make more than half of your annual revenue from selling consumers’ personal information.
And then compliance is pretty much a 3 step process:
1. offer a button for poeple to opt-out selling
2. updating terms of service explaining how data is sold and how to opt out.
3. having a mechanism for people to submit requests for their data, and getting a response within 45 days, with the option to delete all data.
That requires some development time, and I suppose you could automate it to start with but in reality by the time your numbers are that big it will be an easy fix. You should only truly be worried in a startup if your business model is selling user data.

tldr;
If your a startup and not planning on tracking/selling customer data, don't worry about it until your making 25M a year in revenue or have a shit load of customers from CA. Then google what it is and hire a compliance guy.
combition

·
7 years ago
·
1

Not personally but at my day job we're adding CCPA related options in our mobile app .

Shrrttuu

·
7 years ago
·