CCPA Update – Compliance Statistics After One Year of Enforcement and the AG’s “Consumer Privacy Tool”
In little more than a year since the California Attorney General’s Office began enforcing the state’s landmark consumer privacy law—the California Consumer Privacy Act of 2018 (CCPA)—California businesses already show high rates of compliance with the CCPA.
As California Attorney General Rob Bonta recently reported, of businesses receiving a notice of noncompliance with the CCPA, 75% come into compliance within the 30-day “cure” period provided for by the statute. The remainder of business are still within the 30-day window or are being actively investigated by the AG. The types of businesses receiving notices of noncompliance run the gamut, from data brokers and marketing companies to businesses media outlets and online retailers.
But Bonta’s ultimate goal is broader than mere state enforcement. Bonta wants to get consumers to serve as watchdogs and directly report noncompliant businesses to the AG.
In pursuit of this goal, last month, Bonta launched a new online “Consumer Privacy Tool.” This tool allows ordinary consumers to report businesses when they fail to include an easy-to-find “Do Not Sell My Personal Information” link on their website’s homepage as required by the CCPA. The tool asks the user a series of questions about the suspected noncompliant business and then auto-generates a notice of noncompliance to the business. This notice may trigger the 30-day “cure” window, after which the AG can pursue an enforcement action. This tool will only increase the number of businesses alerted to their suspected CCPA noncompliance and possibly subject to investigation and enforcement by the AG.
In last month’s press release announcing the Consumer Privacy Tool, Bonta stated that there is still “more work to be done,” so the Tool will doubtless be the first in a series of efforts intended to inform and empower California consumers with respect to their privacy rights. Meanwhile, we can expect to see the AG’s direct enforcement efforts become more robust and targeted.
In light of the recent launch of the Consumer Privacy Tool, consumers and businesses should expect more enforcement efforts in this space in the months and years ahead. Businesses should take a moment to review whether they are subject to the CCPA, and if so, ensure that their websites and privacy policies are CCPA compliant and that they are able to timely and effectively respond to any CCPA consumer requests for deletion or disclosure of personal information.