The California Consumer Protection Act (CCPA) and the California Privacy Rights Act (CPRA) do not explicitly require a cookie banner, but having a cookie banner can help you meet other requirements. Learn about CCPA and CPRA Privacy Notices here.
The California Consumer Protection Act (CCPA) does not explicitly require a cookie banner, and neither does the California Privacy Rights Act (CPRA). However, if you do have a cookie banner, you can meet other requirements quickly.
The CCPA requires businesses to provide privacy notices to customers. These notices have to be served to users as soon as they arrive on the website. There are various types of notifications, and you can serve any of them as a banner.
Explore more privacy compliance insights and best practices
To better understand your legal responsibilities, you should learn:
Update: California’s Attorney General published the revisions to CCPA’s proposed regulations on February 7, 2020.
CCPA does not apply to every business. It only applies to for-profit companies that collect and process consumer personal information and conduct business in California if the business meets at least one of the following criteria:
CPRA raises the processing criteria from 50,000 Californians to 100,000 Californians, and the earning criteria from 50% of the sales of personal information to 50% of the sales and sharing of personal information.
If your business does not meet these requirements, the CCPA does not apply to you, and you are not required to provide privacy notices.
But if you do meet these requirements, keep reading.
See CCPA 2.0 Update: Latest Changes to the CPREA
According to California privacy laws, all that is required is a privacy notice. The notice's purpose is to inform users about data processing, data sales, or financial incentives in exchange for data. However, it does not request consent to use online trackers.
GDPR, on the other hand, requires businesses to obtain cookie consent. That’s why GDPR-compliant businesses need a GDPR-compliant cookie banner.
The CCPA/CPRA privacy notice provides information on data processing. It is not necessary to obtain consent before collecting data.
The GDPR cookie banner's goal is to inform users about the processing and collect consent for cookies.
Because you process your users' personal information, California consumer privacy laws require you to be transparent with them about it. Privacy notices are the tool that businesses use to inform their customers about their privacy practices.
CCPA and CPRA both require three different types of privacy notices:
The CCPA notice on collection aims to inform consumers that you collect and process their data, what your process is, and why you do so. You have to provide them with the notice at the time of data collection or before. With how tracking technology works, you need to show the notice on your website at the moment of arrival.
You must provide a link to the privacy policy in your notice and the link must lead to the parts of the privacy policy where the required information is provided. You must not take the consumer at the beginning of the privacy policy and let them search for the information they need.
Only businesses that collect personal information are required to provide notice.
Some important rules to remember when it comes to the notice on collection:
Not all businesses sell personal information. Those who do so must notify users and allow them to opt out of the sale or sharing of personal information.
You must provide this notice at the time of collection of consumers’ data. It must include:
The notice must also contain a “Do Not Sell My Personal Information” link. The notice of the consumer's right to opt-out should be placed on the web page to which they are directed after clicking such a link.
Instead of a link to opt-out, the business can choose to offer an alternative opt-out link where the consumer could limit the use of sensitive data as well as opt-out of the sale or sharing of their data.
On top of that, businesses are now obliged to honor opt-out preference signals received by users’ browsers. The most notable example of such a signal is the Global Privacy Control (GPC).
For personal information collected via mobile apps, such as the settings menu, the notice can be placed within the app.
Businesses that process sensitive personal information, such as health data, financial data, ethnic origin, sexual life, political and religious views, and so on, must allow consumers to limit the use of such personal information.
The notice must contain a “Limit the Use of My Sensitive Personal Information” link, which leads to a page where the consumer can learn more about it and make their choice.
Instead of a link to limit, the business can choose to offer an alternative opt-out link where the consumer could limit the use of sensitive data as well as opt-out of the sale or sharing of their data.
Businesses may provide financial incentives to customers in the form of discounts, coupons, loyalty programs, and so on. These financial incentive programs require the processing of personal information. If you process personal data for this purpose, you must provide consumers with a notice on financial incentives.
The notice of financial incentive's purpose is to assist consumers in understanding the tradeoff between providing their information and the financial incentive you provide.
This notice must also be served at the time of data collection. Businesses that operate online can include a separate section in their privacy policies dedicated to financial incentive programs to comply with this requirement.
You can collect the consumers’ data for this purpose as long as you have informed them about the program in the privacy policy.
Adding a privacy policy to your website with Secure Privacy is a breeze. Adding a privacy policy button on your website is equally easy. And if you use Magento and need Magento cookie compliance with a privacy policy, or you use Hubspot, we’ve got you covered.
In addition to these requirements, all privacy notices must meet the following criteria:
Not showing notices or showing non-compliant notices is a violation of the law that can result in penalties.
The maximum penalty for CCPA or CPRA violations is $7,500 per violation per consumer. The fine can be reduced but not increased.
Furthermore, one consumer equals one violation. If you fail to show the notice to 1,000 consumers, that is equivalent to 1,000 violations. 1,000 violations multiplied by $7,500 equals $7,500,000. As a result, the fines can get quite hefty quickly.
Businesses, on the other hand, have 30 days under the CCPA to correct the violation. The CPRA does not allow a correction period.
Read more about CPRA requirements.
Recently The California Privacy Protection Agency (CPPA) issued draft regulations on risk assessment and cybersecurity audits under the CCPA (California Consumer Privacy Act). Learn about CCPA Risk Assessments.
Secure Privacy has created a CCPA-compliant privacy notice solution that is easy to integrate into websites that must follow the law. Our privacy notices will be compliant with the CPRA once it goes into effect. Check out Secure Privacy's Ultimate CCPA Guide.
