One of the most ubiquitous technologies on the web may become a liability risk for businesses. Learn about Google Analytics, wiretap lawsuits, and how to protect your company.
A business must comply with the CCPA if it:
Derives 50 percent or more of its annual revenues from selling or sharing consumers’ personal information.
It sounds simple: do you get 50% of your revenue from selling or sharing information to others? Most retail companies would answer a resounding no.
But if we take a closer look at the requirement, the CCPA isn’t concerned with how much revenue you received from selling personal information, it’s concerned with how much revenue you derived from selling or sharing consumers’ personal information.
Let’s put this in the context of the CCPA’s definitions of "selling" and "sharing." Selling means disclosing or giving access to your consumers' personal information in exchange for monetary or other valuable consideration. Beyond simply receiving cash, this includes receiving discounts on software and other products in exchange for customer data.
Sharing, in the context of the CCPA, means using a consumer's browsing activity on your site or app in order to deliver personalized ads to them on another website. In other words, sharing is interest-based advertising (a.k.a., retargeting). If your business derives 50% or more of your sales revenue from interest-based advertising, the CCPA applies to you.
There are many different ways of calculating if you meet the 50% revenue requirement of the CCPA. We’ll walk you through an example of how a company might make this calculation.
Let’s pretend there is a company that sells ear muffs, Haute Ears. Haute Ears earned $900,000 in revenue in the past 12 months and has an online store only. Below is an example of how they learned that they do in fact need to comply with the CCPA:
Haute Ears began using Google Ads 6 months ago. During that time they saw their revenue increase significantly. Haute Ears closely tracks view-based conversions and click-based conversions.
Let’s discuss what these terms mean.
View-based conversions (also called view-through conversions) occur when a web user views an ad for Haute Ears on Google. The user does not click the ad. If the web user then goes to Haute Ears’s website and buys ear muffs within a 30-day frame, that counts as a view-based conversion.
The timeframe for conversion (30 days) was something that Haute Ears defined; similarly, the action that constitutes a “conversion” was also something that Haute Ears defined. They could also pick a 90-day time frame and consider “conversion” to be someone providing their email to receive discounts and deals.
Click-based conversions occur when a web user views an ad for Haute Ears on Google and clicks on the ad. If the web user then buys ear muffs within a 30-day frame, that counts as a click-based conversion.
Again, the time frame conversion and the conversion event are defined by Haute Ears. Conversion events and timeframes are key decisions a business makes for itself.
Using their website analytics tools, they were able to calculate that $500,000 in sales were linked to either view-based or click based ad conversions.
Haute Ears has derived 55% of their revenue from interest-based advertising, which is considered sharing under the CCPA. Therefore, they must comply with the CCPA.
Disclaimer: This content is provided for general informational purposes only and does not constitute legal or other professional advice. Without limiting the foregoing, the content may not reflect recent developments in the law, may not be complete, and may not be accurate or relevant in an applicable jurisdiction. This content is not a substitute for obtaining legal advice from a qualified licensed attorney in the applicable jurisdiction. The content is general in nature and may not pertain to specific circumstances, so it should not be used to act or refrain from acting based on it without first obtaining advice from professional counsel qualified in the applicable subject matter and jurisdictions.
Get monthly updates on the latest updates on policy & the shifting privacy landscape.
Dive into a world of knowledge, trends, and industry updates on the TrueVault blog.