CCPA and Cookies. What do I need to know?
In this article, we explain the basics of cookies and CCPA.
CCPA is the California Consumer Privacy Act, which was passed by California legislators in June 2018. It’s the most comprehensive law in the USA which is targeted at companies that collect and/or sell personal information and gives private individuals and companies, that are based in California, more control over their own data.
CCPA introduces three major new data protection, including:
- The right to access information. It means that California consumers will be able to know which categories of information are used or sold, from whom and why certain information was collected, etc.
- Right to deletion. Any consumer will be able to ask to delete personal information that was collected about him/her.
- Right to opt-out. Similar to the GDPR, they will be able to direct a company to not sell their personal information to third parties.
The new legislative initiative will go into effect on January 1, 2020. At the same time, some CCPA issues are still in the process of clarifying and amending by local legislators. As a result, several amends were already passed and California attorney general enforcement is not expected until at least July 1, 2020.
CCPA and Cookies
The CCPA allows the use of cookies to collect personal information, but only after you notify users that you collect data. The notice on collection serves the purpose for providing this information to consumers.
The notice on collection contains the following:
- The categories of personal information you collect
- The purposes of data collection
- Information on the right to opt-out of sale of consumers’ personal information, if you sell such information and
- A link to the privacy policy.
You must not use cookies that collect data if you don’t show this notice to the consumer.
The consumer doesn’t have to take any action about it, such as clicking an “Accept” button. That’s not required.
You need just to show the notice and your cookies are good to go.
In addition, if you sell personal information of minors, you must not use cookies to collect their data without obtaining explicit consent.
Secure Privacy allows you to create a custom notice on collection as well as the privacy policy. You need a notice on collection if you collect data from California-based visitors. In general, CCPA requires notice on the collection, which means you have a duty to show them only to your California visitors. Our detailed guide about CCPA gives you valuable tips on how to make your company or website CCPA compliant.
![How to Use Google Consent Mode v2 Outside the EEA and the UK](https://images.prismic.io/secure-privacy/Zp5NZh5LeNNTxWk3_HowtoUseGoogleConsentModev2byRegion.png?ixlib=gatsbyFP&auto=format%2Ccompress&fit=max&q=45)
How to Use Google Consent Mode v2 Outside the EEA and the UK
Discover why using Google Consent Mode v2 outside the EEA and the UK might be unnecessary. Learn about compliance requirements, the impact on data collection, and how to optimize your approach based on regional privacy laws.
- Europe GDPR
![The Impact of Special Purpose 3: Latest Amendments to the IAB Transparency and Consent Framework (TCF) V2.2 Policies by IAB Europe](https://images.prismic.io/secure-privacy/ZpUC_R5LeNNTxJ7o_TheImpactofSpecialPurpose3_LatestAmendmentstotheIABTransparencyandConsentFramework-TCF-V2.2PoliciesbyIABEurope.png?ixlib=gatsbyFP&auto=format%2Ccompress&fit=max&q=45)
The Impact of Special Purpose 3: Latest Amendments to the IAB Transparency and Consent Framework (TCF) V2.2 Policies by IAB Europe
Discover how the latest amendments to the IAB Transparency and Consent Framework (TCF) V2.2, particularly the introduction of Special Purpose 3 (SP3), are transforming user consent and transparency in the digital advertising ecosystem. Learn about the new requirements for protecting children's privacy, preventing dark patterns, and ensuring explicit consumer consent.
- Europe GDPR
![Understanding the Difference Between a PIA and DPIA in GDPR Privacy Risk Assessments](https://images.prismic.io/secure-privacy/ZonRuR5LeNNTw2___UnderstandingtheDifferenceBetweenaPIAandDPIAinGDPRPrivacyRiskAssessments.png?ixlib=gatsbyFP&auto=format%2Ccompress&fit=max&q=45)
Understanding the Difference Between a PIA and DPIA in GDPR Privacy Risk Assessments
Learn the key differences between Data Protection Impact Assessments (DPIAs) and Privacy Impact Assessments (PIAs). Understand their importance in ensuring compliance with privacy laws and best practices for mitigating privacy risks.
- Europe GDPR
- Data Protection