--- title: "The California Consumer Privacy Act: Impacts and Considerations" description: The CCPA (California Consumer Privacy Act) is the new kid on the infosec block - drafted in 7 days, the CCPA borrows much from its bigger, elder sibling, but there are some notable differences between it and GDPR. image: https://blog.flexmr.net/hubfs/CCPA%20Image%201.jpg --- close ## Ready to level up your insights? Get ready to streamline, scale and supercharge your research. Fill out this form to request a demo of the InsightHub platform and discover the difference insights empowerment can make. A member of our team will reach out within two working days. close ## Cost effective insights that scale Quality insight doesn't need to cost the earth. Our flexible approach helps you make the most of research budgets and build an agile solution that works for you. Fill out this form to request a call back from our team to explore our pricing options. [![FlexMR logo](https://www.flexmr.net/skin/images/images-custom/2b221b67-b091-4584-9017-872ee2ddf960-logo.svg)](https://www.flexmr.net/) Book a Demo Request Pricing [Contact Us](https://www.flexmr.net/contact/) Menu - [Home](https://www.flexmr.net/) - [InsightHub](https://www.flexmr.net/insighthub/) - [What is InsightHub?](https://www.flexmr.net/insighthub/) - [Data Collection](https://www.flexmr.net/insighthub/data-collection/) - [Data Analysis](https://www.flexmr.net/insighthub/data-analysis/) - [Data Activation](https://www.flexmr.net/insighthub/data-activation/) - [Research Templates](https://blog.flexmr.net/topic/survey-templates/) - [Information Security](https://www.flexmr.net/insighthub/information-security/) - [Services](https://www.flexmr.net/services/) - [Our Expert Services](https://www.flexmr.net/services/) - [Support & Education](https://www.flexmr.net/services/support-and-education/) - [Consultative Services](https://www.flexmr.net/services/consultative-services/) - [Insight Delivery](https://www.flexmr.net/services/insight-delivery-services/) - [Research Methods](https://www.flexmr.net/methods/) - [Sectors We Work With](https://www.flexmr.net/sectors/) - [About](https://www.flexmr.net/about/) - [About Us](https://www.flexmr.net/about/) - [Leadership](https://www.flexmr.net/about/leadership/) - [Meet the team](https://www.flexmr.net/about/meet-the-team/) - [Advisory Board](https://www.flexmr.net/about/advisory-board/) - [Press & Media](https://resources.flexmr.net/tag/press) - [Accolades](https://www.flexmr.net/about/accolades/) - [Careers](https://www.flexmr.net/about/careers/) - [Blog](https://blog.flexmr.net/) - [Resources](https://resources.flexmr.net) - [Contact](https://www.flexmr.net/contact/) - [Book a Demo](https://blog.flexmr.net/) - [Request Pricing](https://blog.flexmr.net/) - [Home](https://www.flexmr.net/) - [InsightHub](https://www.flexmr.net/insighthub/) - - [What is InsightHub?](https://www.flexmr.net/insighthub/) - [Data Collection](https://www.flexmr.net/insighthub/data-collection/) - [Data Analysis](https://www.flexmr.net/insighthub/data-analysis/) - [Data Activation](https://www.flexmr.net/insighthub/data-activation/) - [Research Templates](https://blog.flexmr.net/topic/survey-templates/) - [Information Security](https://www.flexmr.net/insighthub/information-security/) - ![Camp InsightHub](https://blog.flexmr.net/hubfs/Website_Files/Images/Navigation/camp_insighthub_nav.png) Embark on a new adventure. Join Camp InsightHub, our free demo platform, to discover the future of research. [Sign Up Today](https://insighthub.flexmr.net/users/new) - ![FlexMR InsightHub](https://blog.flexmr.net/hubfs/Website_Files/Images/Navigation/insighthub_screenshot.png) Read a brief overview of the agile research platform enabling brands to inform decisions at speed in this PDF. [Download Brochure](https://blog.flexmr.net/hubfs/Public_Files/InsightHub_Brochure.pdf) - ### InsightHub on the Blog - [Surveys, Video and the Changing Face of Agile Research](https://blog.flexmr.net/surveys-video-changing-agile-research) - [Building a Research Technology Stack for Better Insights](https://blog.flexmr.net/research-technology-stack) - [The Importance of Delegation in Managing Insight Activities](https://blog.flexmr.net/delegation-importance-insight-activities) - [Common Insight Platform Pitfalls (and How to Avoid Them)](https://blog.flexmr.net/platform-pitfalls-how-to-avoid-them) - [Services](https://www.flexmr.net/services/) - - [Our Expert Services](https://www.flexmr.net/services/) - [Support and Education](https://www.flexmr.net/services/support-and-education/) - [Consultative Services](https://www.flexmr.net/services/consultative-services/) - [Insight Delivery Services](https://www.flexmr.net/services/insight-delivery-services/) - [Research Methods](https://www.flexmr.net/methods/) - [Sectors We Work With](https://www.flexmr.net/sectors/) - ![FlexMR Services Team](https://blog.flexmr.net/hubfs/Website_Files/Images/Navigation/services.jpg) Our services drive operational and strategic success in challenging environments. Find out how. [Download Brochure](https://blog.flexmr.net/hubfs/Public_Files/Brochures/FlexMR_Services_Brochure.pdf) - ![Video Close Connection Programme](https://blog.flexmr.net/hubfs/Website_Files/Images/Navigation/video_services.jpg) Close Connections bring stakeholders and customers together for candid, human conversations. [Read Press Release](https://resources.flexmr.net/close-connections-launch) - ### Explore our Practices - [Communities Practice](https://www.flexmr.net/insighthub/) - [Closeness Practice](https://www.flexmr.net/practices/customer-closeness/) - [CX Practice](https://www.flexmr.net/practices/customer-experience/) - [Insight Communications Practice](https://www.flexmr.net/practices/insight-communications/) - [About](https://www.flexmr.net/about/) - - [About Us](https://www.flexmr.net/about/) - [Leadership](https://www.flexmr.net/about/leadership/) - [Meet the Team](https://www.flexmr.net/about/meet-the-team/) - [Advisory Board](https://www.flexmr.net/about/advisory-board/) - [Press & Media](https://resources.flexmr.net/tag/press) - [Accolades](https://www.flexmr.net/about/accolades/) - [Careers](https://www.flexmr.net/about/careers/) - ![FlexMR Credentials Deck](https://blog.flexmr.net/hubfs/Website_Files/Images/Navigation/flexmr_credentials.png) The FlexMR credentials deck provides a brief introduction to the team, our approach to research and previous work. [Download Credentials](https://blog.flexmr.net/hubfs/Public_Files/Brochures/FlexMR_Credentials.pdf) - ![FlexMR Insights Empowerment](https://blog.flexmr.net/hubfs/Website_Files/Images/Navigation/insights_empowerment.png) We are the insights empowerment company. Our framework addresses the major pressures insight teams face. [Download Brochure](https://blog.flexmr.net/hubfs/Public_Files/Brochures/Insights_Empowerment_Brochure.pdf) - ### Latest News - [Insight as Art Shortlisted for AURA Innovation Award](https://resources.flexmr.net/aura-innovation-award-2021) - [FlexMR Launch Video Close Connection Programme](https://resources.flexmr.net/close-connections-launch) - [VideoMR Analysis Tool Added to InsightHub](https://resources.flexmr.net/videomr-launch) - [FlexMR Makes Shortlist for Quirks Research Supplier Award](https://resources.flexmr.net/quirksmr-mr-supplier-award-2020) - [Blog](https://blog.flexmr.net) - - [Latest Posts](https://blog.flexmr.net) - [Strategic Thinking](https://blog.flexmr.net/topic/strategic-thinking) - [Technology & Trends](https://blog.flexmr.net/topic/tech-trends) - [Research Methods](https://blog.flexmr.net/topic/research-methods) - [Practical Application](https://blog.flexmr.net/topic/practical-application) - [Insights Empowerment](https://blog.flexmr.net/topic/insights-empowerment) - [View Full Blog Archives](https://blog.flexmr.net/all) - ![FlexMR Close Connection Programme](https://blog.flexmr.net/hubfs/Website_Files/Images/Navigation/close_connection.png) Discover how to build close customer connections to better support real-time decision making. [Build Connections](https://blog.flexmr.net/practical-support-real-time-decisions) - ![Market Research Playbook](https://blog.flexmr.net/hubfs/Website_Files/Images/Navigation/market_research_playbook.png) What is a market research and insights playbook, plus discover why should your team consider building one. [Discover Playbooks](https://blog.flexmr.net/market-research-playbook) - ### Featured Posts - [Five Strategies for Turning Insight into Action](https://blog.flexmr.net/5-strategies-turn-insights-into-action) - [How to Design Surveys that Ask the Right Questions](https://blog.flexmr.net/effective-survey-design-guide) - [Scaling Creative Qual for Rich Customer Insight](https://blog.flexmr.net/scale-creative-qual-rich-understanding) - [How to Measure Brand Awareness: The Complete Guide](https://blog.flexmr.net/measure-brand-awareness) - [Resources](https://resources.flexmr.net) - - [All Resources](https://resources.flexmr.net) - [Client Stories](https://resources.flexmr.net/tag/case-studies) - [Whitepapers](https://resources.flexmr.net/tag/whitepapers) - [Events & Webinars](https://resources.flexmr.net/tag/events) - [The Open Ideas Panel](https://ideas.flexmr.net/auth/sign_in) - [InsightHub Help Centre](https://help.flexmr.net/en) - [FlexMR Client Network](https://www.linkedin.com/groups/9165407/) - ![Insights Empowerment Readiness Calculator](https://blog.flexmr.net/hubfs/Website_Files/Images/Navigation/insights_calculator.png) The insights empowerment readiness calculator measures your progress in building an insight-led culture. [Get Your Score](https://resources.flexmr.net/insights-empowerment-calculator) - ![MRX Lab Podcast](https://blog.flexmr.net/hubfs/Website_Files/Images/Navigation/flexmr_podcast.png) The MRX Lab podcast explores new and novel ideas from the insights industry in 10 minutes or less. [Listen Now](https://resources.flexmr.net/mrx-lab-podcast) - ### Featured Stories - [Specsavers Informs Key Marketing Decisions with InsightHub](https://resources.flexmr.net/specsavers) - [The Coventry Panel Helps Maintain Award Winning CX](https://resources.flexmr.net/coventry-building-society) - [Isagenix Customer Community Steers New Product Launch](https://resources.flexmr.net/isa-insights) - [Curo Engage Residents with InsightHub Community](https://resources.flexmr.net/curo) - [Research Methods](https://blog.flexmr.net/topic/research-methods) / - [Strategic Thinking](https://blog.flexmr.net/topic/strategic-thinking) / 8 MIN READ ## The California Consumer Privacy Act: Impacts and Considerations #### Amy Ismay # [Workshops and Beacons: A Guide to Building Custome...](https://blog.flexmr.net/workshops-beacons-customer-salience) Most organisations are not short of data, insight or decks.Their biggest challenge is not whether cu... [Read more](https://blog.flexmr.net/workshops-beacons-customer-salience) 9 MIN READ #### Ed Hill - [Events (1)](https://blog.flexmr.net/topic/events) - [Insights Empowerment (38)](https://blog.flexmr.net/topic/insights-empowerment) - [Practical Application (178)](https://blog.flexmr.net/topic/practical-application) - [Research Methods (285)](https://blog.flexmr.net/topic/research-methods) - [Strategic Thinking (232)](https://blog.flexmr.net/topic/strategic-thinking) - [Survey Templates (7)](https://blog.flexmr.net/topic/survey-templates) - [Tech & Trends (397)](https://blog.flexmr.net/topic/tech-trends) The CCPA (California Consumer Privacy Act) is the new kid on the infosec block: GDPR’s younger sibling. It’s been over 18 months since the GDPR (General Data Protection Regulations) was first enforced, unifying data privacy laws throughout Europe and bringing consumers, research participants, and business operators into alignment and equal understanding beneath them. Drafted in 7 days, the CCPA borrows much from its bigger, elder sibling, but there are some notable differences between it and GDPR. | ![Tweet from FlexMR](https://www.flexmr.net/images/webpage-images/45-tweet-this-from-flexmr.png) | ***Tweet This*** | | --- | --- | | [The CCPA (California Consumer Privacy Act) is the new kid on the infosec block - drafted in 7 days, the CCPA borrows much from its bigger, elder sibling, but there are some notable differences between it and GDPR.](https://ctt.ac/ZG2A1) | | A recent survey by ESET – a global leader in IT security – revealed that 44% of respondents had never heard of the CCPA; less than 12% of those surveyed knew whether the law applies to their business. Those of you who, like me, work in the world of infosec, will be very aware of the CCPA, but those outside of data security most likely won’t be. ### What is the CCPA? The CCPA was enacted in 2018 and came into force on 1st January 2020. It applies to any business that: - Collects, shares, or sells customer data of more than 50,000 people - Has a gross annual revenue of more than $25 million - Earns more than half of its annual revenue from selling consumers’ personal information Cited as being an American move towards a GDPR-style privacy law, the CCPA offers California residents the chance to have agency over *some* of their personal information – with ‘some’ being the operative word. Where the GDPR restricts the collection and processing of personal information under specific circumstances, the CCPA operates on an opt-out basis, only allowing Californians to say no to the sale of their data to third parties. Whereas GDPR allows access to all EU personal data processed by a company, the CCPA gives Californians a right to access personal information collected from them in the last 12 months. For, whilst the CCPA is a positive step for U.S. citizens, it is not as comprehensive as European GDPR. Enforcement penalties under the CCPA, whilst not enforceable until July this year, differ from that of the GDPR; a breach of the EU data law has penalties capped at €20million, or 4% of a business’s global annual revenue (whichever is higher). Enforcement penalties of the CCPA range from up to $2500 per unintentional violation, and $7500 per intentional violation. The CCPA differs in other ways to what businesses have become used to: it doesn’t require a legal basis for the collection and use of personal data; it doesn’t restrict the transfer of data outside the U.S; it doesn’t call for businesses to appoint a Data Protection Officer, or to conduct impact assessments. There are also no directly imposed security requirements under CCPA, however it does allow for a right of action against businesses that suffer certain data breaches. ### What impact will the CCPA have? Where companies have had to work to improve transparency with regard to data collection, compliance with the CCPA will be made much simpler thanks to procedures meeting the requirements of GDPR. Where there may be some confusion is around the CCPA’s broadening of the term ‘data subject’ and its interpretation of ‘personal information’. As far as the Californian law is concerned, both the consumer and the household are identifiable entities, and therefore personal information under the CCPA includes IP address, biometric information, device identifiers and location, on top of the usual name, date of birth and email address. Market research companies have got used to what constitutes ‘personally identifiable information’ (PII) under the GDPR, and are now going to have to become conversant with the CCPA’s ‘personal information’: *“anything that identifies, relates to, describes, is capable of being associated with, or could be reasonably linked, directly or indirectly, with a particular consumer or household.”* The terminology here could prove problematic for businesses, particularly around the terms “reasonably” and “is capable of”. To use an example, if you are using third party data to append to your customer’s information in your database, you might not record the source of this information. If the participant revokes the right to use this information from the third party, you would also no longer have permission to use that data. With this sort of scenario in mind, there is potential that some company databases may need reconfiguring to ensure compliance; guaranteeing the traceability of data, and the accurate recording of its origin. With regard to the CCPA notion of the ‘household’, more guidance is needed - for example, what if not all members of the household agree on a data access request? Indeed, in reading the CCPA you realise there are a few blurry areas (remember, the Act was written in 7 days). This ‘blurriness’ has been noted, and the CPREA (California Privacy Rights and Enforcement Act) has been drawn-up and tabled for 2020 approval. Whilst this will hopefully bring some clarity, it will have a big impact, adding more stipulations to the Act that will potentially require an amendment to companies’ compliance processes already designed. All 50 states have enacted data breach notification requirements since the advent of GDPR; more states are expected to follow with privacy laws similar to the CCPA – Vermont and South Carolina have already updated theirs. This will undoubtedly have impact on the industry, particularly as there is no guarantee that all state laws will correspond: you could potentially have to comply with one Act for a participant from California and another for a participant in Maine. ### What are we doing about it? Mutual respect is non-negotiable. At FlexMR we recognise that our participants need to know and believe that we respect their rights and their sensitive data; we can’t rely on the natural responses of research participants if they don’t have trust in our processes or our intentions. | ![Tweet from FlexMR](https://www.flexmr.net/images/webpage-images/45-tweet-this-from-flexmr.png) | ***Tweet This*** | | --- | --- | | [Mutual respect is non-negotiable - consumers need to know we respect their data and rights, and we can’t rely on the natural responses of research participants if they don’t have trust in our processes or our intentions.](https://ctt.ac/8tM9w) | | We process all data in compliance with GDPR. Safeguards integrated at the heart of our platform allow us to confidently guarantee compliance with GDPR, and now also permit us to feel certain that we are fully compliant with CCPA. As a company we do not get involved in the sale of data to third parties, meaning a large part of the CCPA as it currently stands does not impact us. For the remainder of the Act, knowledge that we meet stringent GDPR requirements brings assuredness that our policies and processes will also mean CCPA compliance; established practice will simply require amendment to reflect the CCPA’s different terminology and timescales. As with other regulatory documentation, the CCPA does not furnish us with a rubric approach; the practicality of compliance requirements are not easily gleaned from the statutory language and it is this non-specificity that makes most companies fret. Whilst I would posit that most GDPR-compliant companies will be on the front-foot in preparing for it, it’s worth everyone involved in the MR industry taking the time to evaluate the impact of the CCPA and other new burgeoning data privacy laws on the wholesale collection, management, use, and retention of personal data. [![New call-to-action](https://no-cache.hubspot.com/cta/default/1682149/a07b9b9f-fee9-447c-a050-1e3fa9d77f53.png)](https://cta-redirect.hubspot.com/cta/redirect/1682149/a07b9b9f-fee9-447c-a050-1e3fa9d77f53) #### About FlexMR We are The Insights Empowerment Company. We help research, product and marketing teams drive informed decisions with efficient, scalable & impactful insight. #### About Amy Ismay Amy is experienced in governance and data management, helping FlexMR retain our reputation as a trusted market leader. #### Stay up to date ## You might also like... ![Blog Featured Image Header](https://blog.flexmr.net/hubfs/Marketing_Files/Blogs/Headers/ways_build_customer_salience_focus_groups.png) ### [5 Ways to Using Focus Groups to Bol...](https://blog.flexmr.net/focus-group-customer-salience) In today’s complex business environment, customer-centricity is no longer a competitive advantage, it’s a baseline expectation. That being said, many organisations still struggle to move from talking ... [Continue reading](https://blog.flexmr.net/focus-group-customer-salience) 7 MIN READ ![Blog Featured Image Header](https://blog.flexmr.net/hubfs/Marketing_Files/Blogs/Headers/qual_research_methods.png) ### [4 Qualitative Research Methods to I...](https://blog.flexmr.net/qualitative-research-methods-customer-centricity) In today’s data-obsessed world, it’s easy to get lost in quantitative data with businesses able to generate quantitative data at scale in quicker times than ever before. But true insight experts know ... [Continue reading](https://blog.flexmr.net/qualitative-research-methods-customer-centricity) 8 MIN READ ![Blog Featured Image Header](https://blog.flexmr.net/hubfs/Marketing_Files/Blogs/Headers/10_common_questions_about_insighthub.png) ### [10 Common Questions About InsightHu...](https://blog.flexmr.net/10-common-questions-about-insighthub) With a suite of impactful integrated data collection, analysis and activation tools, FlexMR’s InsightHub platform is used by many insight teams and experts for impactful insight generation and activat... [Continue reading](https://blog.flexmr.net/10-common-questions-about-insighthub) 13 MIN READ ![](https://www.flexmr.net/skin/images/images-custom/48f118ee-cef9-42d6-b60b-5575d5ac26e3-flexmr_footer.svg) - [Home](https://www.flexmr.net/) - [Contact Us](https://www.flexmr.net/contact/) - [Privacy Policy](https://www.flexmr.net/legal/privacy/) - [Cookie Policy](https://www.flexmr.net/legal/cookies/) - [Terms of Use](https://www.flexmr.net/legal/terms-of-use/) [Follow us on Facebook](https://www.facebook.com/flexmr/) [Follow us on Twitter](https://twitter.com/_flexmr) [Follow us on LinkedIn](https://www.linkedin.com/company/flexmr) [Follow us on YouTube](https://www.youtube.com/c/FlexmrNetOnlineResearch) [![Grit Top 50 Logo](https://www.flexmr.net/uploads/photo-gallery-include-images/34/44258f4d-7452-40d6-bb23-0e220c8ba21f.png)](https://www.greenbook.org/mr/grit/business-innovation-edition) [![ISO 27001 Alcumus](https://www.flexmr.net/uploads/photo-gallery-include-images/34/fa89f9b3-d866-43b8-8de0-4a052a9053d8.png)](https://www.alcumus.com/en-gb/certification/iso-27001/) [![Cyber Essentials Plus Logo](https://www.flexmr.net/uploads/photo-gallery-include-images/34/cba57df6-75a2-4544-9599-dcc0c2f14b79.png)](https://blog.flexmr.net/hubfs/Public_Files/Other/FlexMR_Cyber_Essentials_Certificate.pdf?__hstc=163229475.dde2c3d212762f49b059c9f62e7537a0.1624542718433.1626339489304.1626701624468.7&__hssc=163229475.2.1626701624468&__hsfp=3142549060) © FlexMR 2021. All rights reserved. ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Amy Ismay", "url" : "https://blog.flexmr.net/author/amy-ismay" }, "dateModified" : "2021-07-22T12:32:28.999Z", "datePublished" : "2020-02-05T15:00:37.000Z", "headline" : "The California Consumer Privacy Act: Impacts and Considerations", "image" : [ "https://blog.flexmr.net/hubfs/CCPA%20Image%201.jpg" ], "mainEntityOfPage" : { "@id" : "https://blog.flexmr.net/ccpa-impacts-and-considerations", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://blog.flexmr.net/hubfs/Website_Files/Images/Logos/flexmr_logo_amp.png" }, "name" : "FlexMR" } } ```