Five steps to compliance with the California Consumer Privacy Act
At GDC Summer, Will Bucher outlines how companies already complying with GDPR can ensure CCPA compliance too
Earlier this year, the California Consumer Privacy Act took effect, implementing new requirements on companies that do business in and California and handle the data of the state's residents.
At GDC Summer, litigation associate Will Bucher from law firm Debevoise and Plimpton gave a talk on how gaming companies that are already complying with GDPR need to consider the CCPA, and five simple steps they can take to ensure compliance with the act.
Does the California Consumer Privacy Act apply to you?
Bucher began his talk by noting that his presentation is specifically for those who are already complying with GDPR, which impacts companies that do business in the EU or with EU citizens. For those that aren't, there are many more steps to be taken that he didn't cover in this talk.
For companies that already comply with GDPR, Bucher outlined how to determine if the CCPA applies to a company based on two requirements. The first requirement is that a company must do business in California -- and given that this includes doing business with companies based in California such as Valve or Apple, it's fairly likely most gaming companies will meet this requirement.
However, they also have to meet a second requirement: either a company must have annual revenue greater than $25 million, or possess data on more than 50,000 California residents (for example, if 50,000 people who live in California have purchased a game and are playing it online), or derive more than 50% of its revenue from selling Californian consumer data.
This means that some small start-ups and independent studios might not qualify, or smaller companies making single-player games that don't collect data such as IP addresses. However, if a company ever expects to clear any of these hurdles, Bucher recommends looking into the CCPA requirements anyway, as they may become relevant down the line if the company has a successful release.
Bucher noted that the final requirement, deriving more than 50% of revenue from selling Californian consumer data, will likely not apply to most game companies, but is nonetheless worth mentioning.
Step 1: Bring California users into your GDPR protocols
If you know that your company falls under the CCPA, then the first step is to bring your Californian users into your existing GDPR protocols.
Given that CCPA applies when doing business with companies based in California, such as Valve or Apple, it's fairly likely most gaming firms need to be compliant
Understanding that it can be challenging to separate out California-based users from other users depending on the data you have on them, Bucher noted that you can meet this qualification by simply bringing in all US users, or even just all users. He added that this can also be helpful to future-proof your company, in case more states add these requirements in the future.
Essentially, this means treating requests from these customers the same as you would for EU residents under the GDPR, with the added requirement that you must confirm receipt of Californian consumer requests within 10 days -- faster than the timeline for EU residents.
Step 2: "Do Not Sell My Personal Information" link
The next step is to implement a link on your company's website that says "Do Not Sell My Personal Information."
Bucher was clear that the link must use that specific phrasing, and it must take the user to a webpage where they can opt-out of the sale of their data.
Additionally, you cannot require a user to create an account to use the link the opt-out.
Treat requests the same as you would under GDPR, with the added requirement that you must confirm receipt of Californian consumer requests within 10 days
However, the placement of that link can have a bit more flexibility. Bucher noted that while consumers have come to expect to see such links at the bottom of a company's webpages, the goal is to make sure that link is accessible to customers where they interact with the company. And for many game companies, their customers don't interact with them as frequently via webpages. For them, it may make more sense to put the link in the settings menu of the game itself.
As for what happens once consumers opt-out, you can either create a process which excludes their data from sale, or delete the consumer's data entirely as you would when processing a deletion request under the GDPR. Both of these options meet the requirement, though the second one is technically safer and easier because it both already falls into the processes for GDPR, and also avoids the problem if a consumer's data is accidentally tagged incorrectly and sold despite them opting out.
Step 3: Create a toll-free number for data sale opt-outs
Bucher acknowledged that Step 3 is a bit antiquated, but it's still a requirement -- companies need to have a toll-free number consumers can call if they decide they want to opt-out of having their data sold -- which will then be handled in the same way as if they opted-out via your website.
This number must connect them with an employee of your company that is trained to receive these requests, including informing consumers about their rights under the CCPA -- it's fine if this employee overlaps with the employee trained to respond to GDPR requests, too. The line can be staffed within your company's normal operating hours.
Bucher also pointed out that even if you've heard of the "exemption" to this step and think you might qualify, chances are, you don't.
"You do not qualify for the exemption," he said. "And that's because the exemption is worded in such a way that it's almost impossible to comply with."
Specifically, the exemption specifies that you can have no interaction with your consumers offline -- that means no offline marketing, no trade shows, no answering phone calls for troubleshooting problems, no handing out physical media, and no business cards. Plus, you also have to have a direct relationship with every single one of your customers.
"Maybe you have a business model I haven't thought of -- I don't mean to completely say there's no way you're exempt, but I think for all practical purposes, you really have to treat this like you need to create a telephone number."
Companies need to have a toll-free number consumers can call if they decide they want to opt-out of having their data sold
And you also need to ensure its description of data use explains all possible uses that involve any transfer which has even a remote benefit to your company -- including examples such as transferring data to your publisher -- and also describe which categories of data are sold.
For the latter, this needs to include any categories of data from a very specific list dictated by the CCPA. If you sell any of the categories of data listed here, you must note that in your policy:
- Identifiers, such as real name, alias, postal address, unique personal identifier, online identifier, IP address, email, account name, social security number, driver's license number, or passport number
- Consumer information, which includes payment information
- Any legally protected characteristics
- Commercial purchasing
- Biometric information
- Internet or network Activity
- Information typically detected by the senses: audio, electronic, visual, thermal olfactory, or otherwise
- Employment information
- Education information
- And any inferences from the above used to profile the customer
The most important thing, Bucher continued, is to change the date of your last review and update. That doesn't necessarily mean you have to change anything else if there's nothing that needs changing -- it can be as simple as reading the policy through and changing the date.
For smaller companies, it's easy enough to set a calendar reminder once a year to do this -- though Bucher noted that larger companies might need a dedicated compliance role for this or the entire process.