For the second installment of this series on the new California Consumer Privacy Act (CCPA) Regs, we are looking at consumer request processes.
One major eye opener: Tracker opt-outs must be immediate and you may not be able to use voicemail for your toll-free phone number.
Here are some other issues we are working on with our clients:
- Make sure to include links (like the do not sell link) on every page where personal information is collected (not just the homepage).
- Mind your webforms interface.
- Do not require consumers to fill out multiple or duplicative forms or impose unnecessary waiting periods between form submissions.
- If you require the consumer to call a toll-free telephone number to submit a CCPA request, make sure that the individuals handling those phone calls have the knowledge and ability to process the consumer’s CCPA requests. Of note, this seems to go against using a voicemail for this method.
- For authorized agent: Mind the Honda requirements: Do not require a consumer to resubmit the request in their individual capacity.
- For the right to know: Provide a means by which the consumer can request that the business provide personal information collected prior to the 12-month period preceding the business’s receipt of the consumer’s request.
- For right to correct: If you are not the source of the relevant data, you must provide the consumer with the name of the source from which the business received the alleged inaccurate information, or in the alternative, inform the source that the information provided is incorrect and must be corrected.
- For opt-out, make sure that the opt out can be carried out instantaneously (e.g. sharing through tags or pixels) or within a week (e.g. batch notification). Do not take 15 business days to do it.
- For the automated opt out signal, make sure that you display the status of the consumer’s choice.