California Consumer Privacy Act (CCPA)

[Honeybadger]

Does this affect anonymous data tracking as well as personally-identifiable data tracking?

"On January 1, 2020, the California Consumer Privacy Act (CCPA) will go into effect. As a publisher, you are classified as a "Business" under CCPA. This means you must adhere to certain requirements of the Act with respect to your business operations, your interactions with California consumers, and your interactions with other businesses. It is important that we know whether the California consumer data you send to us was collected in a CCPA-compliant manner."

• California Consumer Privacy Act (CCPA)
• California Consumer Privacy Act - Wikipedia

 

[T J Tutor]

anonymous data tracking

It does! I think it is mostly about what you do with the data once you have it. It also has a requirement for transparency to those you collected the data from.

AB 375 allows any California consumer to demand to see all the information a company has saved on them, as well as a full list of all the third parties that data is shared with. In addition, the California law allows consumers to sue companies if the privacy guidelines are violated, even if there is no breach.

All companies that serve California residents and have at least $25 million in annual revenue must comply with the law. In addition, companies of any size that have personal data on at least 50,000 people or that collect more than half of their revenues from the sale of personal data, also fall under the law. Companies don't have to be based in California or have a physical presence there to fall under the law. They don't even have to be based in the United States.

 

[Honeybadger]

Would not being able to identify someone preclude an affiliate being able to fulfil any request for their information, and therefore not fall under those rules?
- assuming the affiliate doesn't have $25 million or data on 50,000 people

 

[T J Tutor]

My position is to always err on the side of caution. I would rarely allow my business practices to skirt an issue for being less than a requirement invoked on others.

I can tell you that you will hit 50k in no time once you've been in the game a year or two, and for many that can be less than a year. I collected more than 100k in year one from a content site I launched just three years ago.

Here is the thing. When restrictions, policies, and rules of this nature are imposed, it is typically a great practice to implement them immediately whether you are less than, or approaching, the limitations for requirements or not. This not only prepares you for any inquiries, but it also gives the appearance others will see as if you are of the success and size that requires compliance. That is a psychological advantage you can't buy if you wanted to.

 

[Graybeard]

Database management,
Anonymous IDs like like IP encryption one-way SHA or similar
Getting consumer approval for any 3rd party use.

Real can of worms

 

[Honeybadger]

Probably easier to just block all California IP addresses
Many US sites block EU IP addresses due to GDRP

 

[Graybeard]

Block the EU and California? The second and fifth largest economies in the world. Good luck living off the scraps left over.