Does your state have its own version of the TCPA?

Yes. California has what is known as the California Consumer Privacy Act of 2018, which is located in sections 1798.100 to 1798.199.100 of the California Civil Code.

If so, please explain the distinction between the state’s iteration of the TCPA.

The Telephone Consumer Protection Act (TCPA) of 1991 was enacted in response to consumer complaints of robocalls to cellphones. In 2015, the robocall restriction was amended in order to provide an exception for government debt collection. This exception was then found in 2020 to violate the First Amendment and was severed from the TCPA and invalidated.[i]

In 2018, California enacted the California Consumer Privacy Act (CCPA). This law gave consumers specific rights regarding their personal information and enacted requirements for the businesses that collect such information.

Two years later, in 2020, California voters approved Proposition 24, the California Privacy Rights Act (CPRA), which amended the CCPA by adding additional consumer rights and business obligations. The CPRA also established the California Privacy Protection Agency, which was given the responsibility of implementing and enforcing the subject laws and educating the general public on their rights as consumers and the obligations of businesses. The CPRA and CCPA are collectively referred to as the CCPA throughout, with an explanation of what the CPRA changed below.

While both the TCPA and the CCPA focus on protecting consumer privacy, the CCPA focuses on an individual’s personal data, while the TCPA targets telemarketing practice.

For example, the TCPA deals with phone calls and the use of automated dialing programs. The CCPA, on the other hand, deals with businesses collecting individual personal data. While both regulations encompass the broader swath of consumer privacy, the CCPA is much broader.

The TCPA was amended in 2019 to add regulations creating a process that streamlines the ways in which private entities voluntarily share with the FCC information relating to a call or text message sent in violation of the TCPA or a call or text message for which misleading or inaccurate caller ID information was transmitted.

A significant difference between the TCPA and the CCPA is that the TCPA allows for a private right of action by individuals. However, you cannot sue a business under the CCPA for CCPA violations.[ii] Such suit is only allowed if there is a data breach, and even those circumstances are limited. Consumers protected by the CCPA may file a consumer complaint with the Office of the Attorney General and the California Privacy Protection Agency.

Overall, the TCPA deals more with how a business or entity contacts a consumer and interacts with the consumer themselves. The CCPA focuses more on how a business or entity interacts with that consumer with respect to their personal information.

Consumer Rights Under the CCPA

A consumer under the CCPA is a natural person who is a California resident as defined by Title 18 of the California Code of Regulations, Section 17014.

Under the CCPA, consumers have the right to:

• Limit the use and disclosure of sensitive personal information collected about them
• Opt-out of the sale of their personal information
• Correct inaccurate personal information that businesses may have about them
• Know what personal information businesses have collected about them and how those businesses use and share it
• Be treated equally – businesses cannot discriminate against consumers for exercising their rights under the CCPA
• Delete personal information businesses have collected from them, with some exceptions

The right to correct inaccurate personal information that a business has about them, and the right to limit the use and disclosure of sensitive personal information collected about them were both added in the CPRA.

Consumers’ Right to Delete Personal Information

A consumer’s right to delete personal information is sometimes referred to as their right to be forgotten. The CCPA gives consumers the right to request that a business delete any personal information about the consumer which the business has collected from the consumer.[iii] The business that has collected information is required to disclose to the consumer that the consumer can request such deletion.[iv]

Consumers’ Right to Correct Inaccurate Personal Information

A consumer has the right to request that a business correct any inaccurate personal information they have collected about the consumer.[v] This right is qualified, in that such a request requires “taking into account the nature of the personal information and the purposes of the processing of the personal information.”[vi] Similar to other rights of consumers, the business who collects a consumer’s personal information is required to disclose the consumer’s right to correct inaccurate personal information.

Consumers’ Right to Know What Personal Information Is Being Collected and Access It

A consumer has the right to request that a business collecting personal information about the consumer disclose any or all of the following: (1) categories of personal information collected about the consumer for the applicable period of time; (2) categories of sources[vii] from which the personal information was collected; (3) business or commercial purpose for collecting, selling, or sharing the consumer’s personal information; (4) categories of third parties to whom the business discloses the consumer’s personal information; and (5) specific pieces of personal information collected about the consumer.[viii]

Consumers’ Right to Know What Personal Information is Sold or Shared and to Whom

Where a business sells or shares the information collected from a consumer, a consumer has a right to request that a business disclose to the consumer the following:

• The categories of personal information that the business collected about the consumer
• The categories of personal information that the business sold or shared about the consumer and the categories of third parties to whom the personal information was sold or shared
• The categories of personal information that the business disclosed about the consumer for a business purpose and the categories of persons to whom it was disclosed for a business purpose.

A “business purpose” is defined as the use of personal information for the business’s, service provider’s or contractor’s operational purposes, and the use must be reasonably necessary and proportionate to achieve the purpose for which the personal information was collected and processed, or for another purpose compatible with the context in which the personal information was collected.[ix]

Consumers’ Right to Opt Out of Sale or Sharing of Personal Information

A consumer can direct a business that sells or shares their personal information to a third party to refrain from doing so.[x]

Consumers’ Right to Limit Use and Disclosure of Sensitive Personal Information

Sensitive personal information is defined under the CCPA as personal information that reveals certain details about the consumer, biometric information that is processed for the purpose of uniquely identifying a consumer, or personal information about a consumer’s health, sex life, or sexual orientation.[xi]

A consumer may direct a business that collects their sensitive personal information to limit the use of the sensitive personal information to the use which is necessary to perform the services or provide the goods reasonably expected by an average consumer who requests those goods or services.[xii]

Consumers’ Right of No Retaliation Following Opt Out or Exercise of Other Rights

If a consumer exercises any of their above rights, a business shall not discriminate against that consumer in any way, including but not limited to denying goods or services to the consumer; charging different prices or rates for goods or services, including through discounts, benefits, or the imposition of penalties; providing a different level or quality of goods or services to the consumer; and suggesting that the consumer will get a different price or rate for goods or services or a different level or quality of goods or services.[xiii]

Business Obligations Under the CCPA

Defining “Business”

First and foremost, the CPRA amended the definition of “business,” slightly raising the threshold for determining what constitutes a covered “business.”

The CCPA with the CPRA amendments (which when into effect January 1, 2023) defines a business as “[a] sole proprietorship, partnership, limited liability company, corporation, association, or other legal entity that is organized or operated for the profit or financial benefit of its shareholders or other owners, that collects consumers’ personal information, or on behalf of which such information is collected and that alone, or jointly with others, determines the purposes and means of the processing of consumers’ personal information, that does business in the State of California, and that satisfies one or more of the following thresholds:”

• As of January 1 of the calendar year, had annual gross revenues in excess of twenty-five million dollars in the preceding calendar year[xiv];
• Alone or in combination annually buys, sells, or shares, the personal information of 100,000 or more consumers or households;
• Derives 50% or more of its annual revenues from selling or sharing consumers’ personal information.[xv]

An entity that controls or is controlled by a business that is defined by the above paragraph, and shares common branding with that business and with home the business shares consumers’ personal information, is also considered a “business” under the CCPA.[xvi] Any joint venture or partnership composed of businesses in which each business has at least 40% interest, and any person that does business in California but is not covered by the aforementioned definitions, but voluntarily certifies to the California Privacy Protection Agency that it is in compliance with an agrees to be bound by the CCPA will also constitute businesses for the purpose of the act.[xvii] Note that the term “doing business in California” is not defined in the CCPA.

Defining “Personal Information”

Businesses who collect a consumer’s personal information are subject to the CCPA. This begs the question of what “personal information” is.

The CCPA defines personal information as “information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.”[xviii] The definition goes on to provide a non-exhaustive list of the specific types of information that would fall under the personal information umbrella.

Of note, personal information does not include publicly available information or lawfully obtained, truthful information that is a matter of public concern.[xix]

Obligations

There are a whole host of obligations under the CCPA for businesses who are subject to its regulations.[xx] Broadly speaking, these obligations require business to inform consumers of their rights under the CCPA, ensure that businesses respect those rights and respond to requests and demands by consumers regarding their data, and guarantee that any outside entity who is obtaining access to the consumer information is aware of and subject to the CCPA.

As to a consumer requesting deletion of their personal information, a business must delete the consumer’s personal information pursuant to a request by the consumer, and notify any service providers, contractors, and third parties to whom the information was sold to delete that consumer’s personal information from their records as well.[xxi]

When a business receives a consumer request to correct inaccurate personal information, the business must use commercially reasonable efforts to correct the inaccurate personal information as directed by the consumer.[xxii]

Upon a verifiable consumer request from a consumer, a business who collects personal information from a consumer must disclose to the requesting consumer the information listed in California Civil Code § 1798.110(a) within 45 days of receiving the consumer request.[xxiii] The time period to provide the requested information may be extended once by an additional 45 days when reasonable necessary, provided that the consumer is given notice of the extension within the first 45 day period.

When a consumer requests that a business refrain from selling or sharing their personal information, the business must respect that directive from the consumer unless the consumer subsequently, expressly authorizes the sale or sharing.[xxiv] The business must comply with the consumer’s opt-out request “as soon as feasibly possible” but no later than 15 business days from the date the request was received by the business.[xxv] The business must refrain from sharing the consumer’s information for at least twelve months before asking the consumer to authorize the sale or sharing of their information.

Please address state specific consumer protection statutes that are often paired with TCPA or its state iterations and the additional element and penalties.

Because the CCPA is all encompassing, there are few statutes that are paired with it. Additionally, because the CCPA does not allow for a private right of action, there are no details regarding what other statutes would allow for the enforcement of the CCPA outside of agency enforcement.

Moreover, because the CCPA is relative in its infancy, case law is not yet well developed.

Conduct Not Subject to the CCPA

The CCPA provides for exemptions from the rule under California Civil Code Section 1798.145. Below are instances in which the obligations imposed on business by the CCPA do not apply.

• Compliance with other laws (federal, state, local, or court order/subpoena to provide information)
• Compliance with investigations/subpoenas (civil, criminal, or regulatory inquiries, investigations, subpoenas, or summons from federal, state, or local authorities)
• Cooperation with law enforcement (so long as the business, service provider, or third party reasonably and in good faith believes the conduct in question may violate federal, state, or local laws)
• Disclosure for emergency access (where a person is at risk of danger of death or serious injury provided certain conditions in California Civil Code Section 1798.145(a)(1)(D) are met)
• Exercising or defending legal claims (including allowing businesses to produce consumer personal information in response to civil litigation discovery requests[xxvi]
• Collecting, using, selling, sharing, or disclosing “deidentified”[xxvii] or aggregate consumer information
• Conduct that takes place wholly outside California
• Where compliance would violate a state evidentiary privilege

What are the current best practices to comply with the State’s iteration of the TCPA?

Keep Consumers Informed

A business subject to the CCPA (i.e., one that collects consumers’ personal information) must inform consumers, either at the time of or prior to the collection of such information, of the following:

• The categories of personal information to be collected and the purposes for which such information is collected or used, and whether it is sold or shared
• If sensitive personal information is collected, the categories of this sensitive personal information and the purpose for which it is collected and used, and whether that information is sold or shared
• The length of time the business intends to retain each category of personal information

A business is considered to have made their consumers aware of the above things if they provide this information prominently and conspicuously on the homepage of its internet website.

Additionally, ensure that consumers are made aware of their rights under the CCPA. For example, where a business sells or shares consumer personal information with third parties, they must provide notice to consumers that their information may be sold or shared but that consumers have a right to opt out of such a sale or share.[xxviii] This notice must be in a form that is reasonable accessible to consumers, including a clear and conspicuous link on the business’ internet homepages, titled “Do Not Sell or Share My Personal Information,” which redirects to a webpage enabling a consumer or a consumer’s agent to opt out of and/or limit the share or sale of their personal information.

A description of a consumer’s rights under the CCPA may also be included in a business’s online privacy policy and updated every 12 months. Specifically, the information in the privacy policy must include a description of the consumer’s rights along with two or more designated methods for submitting requests.[xxix]

Ensure Consumers Can Easily Exercise Their Rights

The easiest way to comply with the CCPA is to honor any instance of a consumer attempting to exercise any of their rights. For instance, if a consumer contacts a company and asks that the company delete the personal information it has with respect to that consumer, the company must do so. Specifically, a business must make available to consumers two or more designated methods for submitting requests for information required to be disclosed, or requests for deletion or corrective, including, at a minimum, a toll-free telephone number.[xxx] If the business maintains a website, that website should be available to consumers for them to submit requests for information required to be disclosed, or requests for deletion or correction.[xxxi] Overall, a consumer should be able to exercise their CCPA rights easily and with minimal steps involved.[xxxii]

If a business operates exclusively online and has a direct relationship with a consumer from whom it collects personal information, it must provide an email address for submitting requests for information required to be disclosed, or requests for deletion or correction.[xxxiii]

If a consumer requests their information be deleted, corrected, and/or protected from sale or sharing, do so quickly. A business only has 45 days from a consumer’s request to take appropriate action, with the allowance of only one 45 day extension. To avoid any risk of violation, it is important to act quickly.

[i] Barr v. American Association of Political Consultants, Inc. 591 U.S. 610 (2020).

[ii] Silver v. Stripe, Inc., 2021 WL 319752, at *7.

[iii] California Civil Code § 1798.105(a).

[iv] California Civil Code § 1798.105(b).

[v] California Civil Code § 1798.106(a).

[vi] California Civil Code § 1798.106(a).

[vii] “Categories of sources” is defined as “types or groupings of persons or entities from which a business collects personal information about consumers” that must be described with enough detail “to provide consumers with a meaningful understanding of the type of person or entity.” See California Code of Regulations, Title 11, § 7001(e).

[viii] California Civil Code § 1798.110(a).

[ix] California Civil Code § 1798.140(e) (specific business purposes listed in the statute include auditing, ensuring security and integrity, debugging, short-term, transient use, performing services for a business (i.e., maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, and providing financing, analytic services, storage, or similar services on behalf of the business), advertising or marketing services, internal research, and/or verifying/maintaining quality or safety.).

[x] California Civil Code § 1798.120(a)(1).

[xi] California Civil Code § 1798.140(ae).

[xii] California Civil Code § 1798.121(a).

[xiii] California Civil Code § 1798.125(a).

[xiv] As adjusted pursuant to subdivision (d) of Section 1798.199.95

[xv] California Civil Code § 1798.140(d)(1).

[xvi] California Civil Code § 1798.140(d)(2).

[xvii] California Civil Code § 1798.140(d)(3)-(4).

[xviii] California Civil Code § 1798.140(v)(1).

[xix] California Civil Code § 1798.140(v)(2)(A).

[xx] California Civil Code § 1798.130: Notice, Disclosure, Correction, and Deletion Requirements. California Civil Code § 1798.135: Methods of Limiting Sale, Sharing, and Use of Personal Information and Use of Sensitive Personal Information.

[xxi] California Civil Code § 1798.105(c)(1). A business may maintain a confidential record of deletion requests, but solely for the purpose of preventing the personal information of the consumer from being sold. Id.

[xxii] California Civil Code § 1798.106(a).

[xxiii] California Civil Code § 1798.130(a)(2)(A).

[xxiv] California Civil Code § 1798.120(d).

[xxv] California Code of Regulations, Title 11, § 7026.

[xxvi] Kaupelis v. Harbor Freight Tools USA, Inc., 2020 WL 7383355 at *3.

[xxvii] California Civil Code § 1798.140(m) defining deidentified information as information that cannot reasonably be used to infer information about or otherwise be linked to a particular consumer provided that the business in possession of such information takes reasonable measures to ensure that the information cannot be associated with a consumer, publicly commits to maintain and use the information in a deidentified form, and contractually obligates any recipients of the information to comply with these provisions.

[xxviii] California Civil Code § 1798.135.

[xxix] California Civil Code § 1798.130(a)(5).

[xxx] California Civil Code § 1798.130(a)(1)(A).

[xxxi] California Civil Code § 1798.130(a)(1)(B).

[xxxii] California Code of Regulations, Title 11, § 7004.

[xxxiii] California Civil Code § 1798.130(a)(1)(A).