Effective January 1, 2023, the CCPA provides California residents with certain rights regarding their personal information, including the right to limit the use of their information. The CCPA’s “Limit the Use of My Information” requirements include the following:
- Notice: Businesses subject to the CCPA are required to provide notice to consumers at or before the point of collection of their personal information, informing them of the categories of personal information collected and the purposes for which it will be used. This notice must also include information about the right to request the deletion of personal information and the right to opt-out of the sale of personal information, if applicable. The types of personal information collected may include, but is not limited to Internet Protocol (IP) address, name, address, telephone number, birth date, billing, and delivery information, email address, information about our customer’s credit card or other financial account information, or other identifying information.
- Right to deletion: The CCPA provides consumers with the right to request that a business delete their personal information. Upon receiving a verifiable request, the business must delete the personal information from its records and direct its service providers to do the same, unless certain exceptions apply.
- Right to opt-out: The CCPA provides consumers with the right to opt-out of the sale of their personal information to third parties. Businesses must provide a clear and conspicuous link on their websites titled “Do Not Sell My Personal Information” that allows consumers to opt-out of the sale of their personal information, and they must comply with consumer requests to opt-out.
- Purpose limitation: Businesses must limit the use of personal information collected to the purposes for which it was collected or for purposes that are compatible with the original purpose unless the consumer provides consent for a new purpose.
- Minimization: Businesses must minimize the collection of personal information to what is necessary for the disclosed purposes, and should not collect more personal information than is necessary for those purposes.
- Non-discrimination: The CCPA prohibits businesses from discriminating against consumers who exercise their rights under the CCPA, including the right to limit the use of their personal information.
- Data retention: Businesses must not retain personal information for longer than is necessary for the purposes disclosed in the notice provided to consumers.
- Security: Businesses must implement reasonable security measures to protect the personal information they collect, including measures to prevent unauthorized access, use, or disclosure.
It’s important to note that the CCPA has specific requirements and definitions, and compliance may vary depending on the size and nature of the business, the type of personal information collected, and other factors. Businesses subject to the CCPA should carefully review the law and seek legal advice to ensure compliance with its requirements.