Term 1 of 35
A business may not sell PI of a consumer if it has actual knowledge that the consumer is under 16
years of age unless the sale was affirmatively authorized by (1) the consumer, if the consumer is
13-15 years of age; or (2) the consumer's parent or guardian, if the consumer is under 13.
Regarding its consent requirement, a business may not sell PI of a consumer if it has actual
knowledge that the
consumer is _____ unless the sale was affirmatively authorized by (1) _________ or (2) ____________.
Regarding its consent requirement, a business may enter a consumer into a financial
incentive program only if the consumer gives the business (1) the notices required by CCPA,
(2) a description of the material terms of the financial incentive program, and (3) obtains
the consumer's prior opt-in consent.
Does the CCPA define financial incentive? Explain.
Regarding its transparency requirement, the CCPA substantially changes both the required
contents and online presentation of privacy notices. What are the three general content
requirements of a privacy notice?
Regarding the right to opt out of sale of PI, a consumer may opt out of a business's sale of
the consumer's PI, and may _______.
If a consumer has opted-out of the sale of the consumer's PI, a business must wait ________.
,Definition 2 of 35
Regarding the right to access PI, businesses must honor Californians' requests to access their PI.
If the PI is provided electronically, then the business must provide the PI in a ______
Businesses do not need to honor this request from the same requester more than ______.
A consumer may opt out of a business's sale of the consumer's PI, and may authorize
another person or entity to opt out on the consumer's behalf.
If a consumer has opted-out of the sale of the consumer's PI, a business must wait 12
months before requesting the consumer to re-authorize sale of the PI.
The CCPA is not a consent-based framework - it focuses on transparency and the right to
opt out - but does require consent to sell PI of minors and to enter consumers in rewards or
other financial incentive programs.
In a portable format that allows transfer to another entity.
Businesses do not need to honor this request from the same requester more than once
every 12 months.
(1) At or before the point of collection of PI, a business must inform consumers of the
categories of PI to be collected and the purposes for which each category of PI will be
used.
(2) The business must create a webpage titled "Do Not Sell My Personal Information" that
enables a consumer to opt out of the sale of his or her PI.
,Definition 3 of 35
What is a "business" under the CCPA?
(1) Information governed by other sectoral privacy laws and standards;
(2) Sale of information as part of a merger, acquisition, or bankruptcy.
(3) Conduct solely outside of California;
(4) Legal obligations and proceedings;
(5) exercise of the first amendment
A service provider is a for-profit legal entity that processes
information on behalf of a business and to which the business discloses a consumer'sPI for
a business purpose pursuant to a written contract.
The contract must prohibit the service provider from retaining, using or disclosing PI for
any purpose other than the specific purpose of performing the services required by the
contract.
Similar to a "processor" under the GDPR.
(1) for-profit legal entity; (2) collects personal information of California residents; (3) does
business in California; and (4) satisfies one of the following thresholds: (a) has annual gross
revenues greater than $25 million, (b) annually buys, sells, receives, or shares for
commercial purposes PI of at least 50,000 California residents, (or (c) derives at least 50%
of its annual revenue from selling California consumers PI.
Each affiliate that controls or is controlled by the business and shares business "common
branding" (i.e., name, servicemark or trademark) also forms part of that business, even if
that affiliate itself does not trigger the thresholds.
, Term 4 of 35
A service provider is a for-profit legal entity that processes
information on behalf of a business and to which the business discloses a consumer'sPI for a
business purpose pursuant to a written contract.
The contract must prohibit the service provider from retaining, using or disclosing PI for any
purpose other than the specific purpose of performing the services required by the contract.
Similar to a "processor" under the GDPR.
What two types of information is not considered personal information? That is, the CCPA
does not restrict what two types of information? Explain each.
What is a service provider?
What is the requirement for contracts between businesses and service providers?
How is this similar to the GDPR?
What is a "business" under the CCPA?
Can a company be a "business", "service provider" or "third party" in one context, and play
another of these roles in another? Explain.
The benefits of buying summaries with Stuvia:
Guaranteed quality through customer reviews
Stuvia customers have reviewed more than 700,000 summaries. This how you know that you are buying the best documents.
Quick and easy check-out
You can quickly pay through credit card or Stuvia-credit for the summaries. There is no membership needed.
Focus on what matters
Your fellow students write the study notes themselves, which is why the documents are always reliable and up-to-date. This ensures you quickly get to the core!
Frequently asked questions
What do I get when I buy this document?
You get a PDF, available immediately after your purchase. The purchased document is accessible anytime, anywhere and indefinitely through your profile.
Satisfaction guarantee: how does it work?
Our satisfaction guarantee ensures that you always find a study document that suits you well. You fill out a form, and our customer service team takes care of the rest.
Who am I buying these notes from?
Stuvia is a marketplace, so you are not buying this document from us, but from seller stuuviaa. Stuvia facilitates payment to the seller.
Will I be stuck with a subscription?
No, you only buy these notes for $12.99. You're not tied to anything after your purchase.