California's Privacy Law and a Canadian Website

What takes effect on January 1

The California Consumer Privacy Act takes effect on January 1. Passed in 2018 and amended this year, it gives California residents rights over the personal information businesses collect about them.

The state's Attorney General can begin enforcing it from July 1. The regulations that fill in the detail are still being finalised: a draft was published in October, and public comments closed last Friday.

A Canadian website can fall within it, because the law turns on California residents' information rather than on where a business is based. Most small Canadian businesses will turn out to be outside it.

What follows is a general description, not legal advice. A business near any of the thresholds should speak to a lawyer who works in privacy.

The tests, in plain terms

• A for-profit business, since non-profits are outside it.
• Doing business in California, a phrase the law does not define.
• Annual revenue over 25 million US dollars, counting all sales, not only California's.
• Or information on 50,000 or more California consumers, households or devices a year.
• Or half its annual revenue from selling personal information.

The fourth is the one a website can approach without anyone noticing. Personal information in this law includes identifiers such as IP addresses and cookie IDs, which analytics and advertising tools collect from visitors.

Fifty thousand a year averages fewer than 140 a day. How the law counts them is still being worked through, but a site with many California visitors should look.

Why most small Canadian businesses fall below

A plumbing company in Surrey, a clinic in Kamloops or a restaurant in Victoria has no California customers to speak of, earns nowhere near 25 million US dollars, and sells nobody's data.

Visitors from California may still find its site now and then. A few hundred a year from searches and links is a long way from 50,000.

For businesses like these, the law asks nothing. Their obligations are the Canadian ones they already have.

The ones worth a closer look

Online stores that ship to the United States come first, since California, the most populous state, is often their largest market.

Then tourism businesses with many California guests booking online, and publishers whose articles draw large American audiences, particularly those carrying advertising.

And software and app businesses with users across North America. For any of these, the device count is the threshold to check first, and what counts as selling comes next.

Checking the device count

Universal Analytics gives a rough answer in a minute. Open the location report, choose the United States, then California, and set the date range to the past twelve months.

The users figure there is an approximation. Analytics counts browsers rather than people, so one person on a phone and a laptop counts twice, and someone who clears their cookies counts again.

For a threshold this far away, rough is enough. A figure in the hundreds or low thousands settles it; one in the tens of thousands is a reason to ask a lawyer.

What it asks of a covered business

A covered business must tell California residents, at or before collection, what personal information it collects and why. Its privacy policy must describe their rights and its practices over the previous twelve months.

Residents can ask what has been collected about them, ask for it to be deleted, and opt out of its sale.

A business that sells personal information needs a link on its home page titled Do Not Sell My Personal Information.

Requests must be accepted through at least two methods, including a toll-free number, and answered within 45 days. A business that operates only online and deals directly with its customers may offer just an email address.

And residents who use these rights generally cannot be charged more, or served worse, for doing so.

Selling, in the law's sense

The law defines selling broadly: making personal information available to another business for money or anything else of value.

Whether that includes the data advertising and tracking tools collect on a website has been debated all year, and the draft regulations have not settled it.

Some advertising vendors have announced settings meant for California users.

A business that runs retargeting ads or carries advertising should ask each vendor what it is doing about it.

A worked example

A three-person business on Vancouver Island sells reproduction parts for vintage motorcycles online. California is its largest market outside Canada, which is what prompted the owner to ask whether the law applied.

Revenue was nowhere near 25 million US dollars, and the business sold no data. The open question was the device count.

Analytics showed visitors from California in the low thousands over the past year: a rough guide, but nowhere near 50,000. The owner wrote down the figures and the date, to check again next December.

The exercise still found work to do. The privacy policy had not changed since 2015.

It now says what the store collects and why, which services receive it, such as payments, shipping and email, and how customers can ask to see or correct their information.

Canadian law still applies

Whatever the answer on California, a Canadian business already has privacy obligations at home: PIPEDA federally, and in BC a provincial privacy act that covers many businesses within the province.

Both expect a business to say what it collects and why, get consent, protect what it holds, and let people see and correct their information.

Organisations covered by PIPEDA have also had to log every breach of security safeguards since November last year.

A privacy policy written to meet these laws, and kept accurate, covers most of what a small Canadian business needs.

The counter-case

This summary simplifies a long law.

Businesses that are part of larger groups, share branding with a covered company, or handle unusual kinds of data can be covered in ways a plain reading of the thresholds misses.

The regulations are not final, either, and their final form may change what covered businesses have to do.

For most small Canadian businesses none of that applies. Check the three thresholds once, write down the answer, and keep the Canadian privacy policy current.

Before January 1

1. Check annual revenue against the first threshold.
2. Look up California visitors in Analytics for the year.
3. List who receives your customers' information.
4. Ask whether any of it is sold or traded.
5. Write down the answers with today's date.
6. Update your privacy policy for Canadian law.
7. Ask a privacy lawyer if you are close.

Step three pays off whatever the answer. A list of every service that receives customer information is what a privacy policy needs under Canadian law anyway, and the first thing a lawyer would ask for.

Consent, in Europe's cookie rules and in Canada's anti-spam law, is covered in pre-ticked boxes and cookie consent.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.