The CCPA gives consumers more control over how companies use their personal data.
I recently appeared on MSNBC to talk about my take on California’s new data privacy law introduced this month, the California Consumer Privacy Act — CCPA for short. Effective January 1, 2020, the CCPA outlines new standards for data collection as well as what happens to businesses who fail to protect user data. It also grants California consumers new rights that they can exercise to keep their data secure and out of the hands of bad actors.
I have long supported this kind of change, especially for larger companies that can reasonably afford to take extra precautions such as those required by the CCPA.
I believe the CCPA is a powerful law that will be a big win for both consumers and the businesses who market to them, and it’s helping to put America at the same table as Europe in the global privacy discussion. For the first time in American history, consumers get to know what a company knows about them, decide whether or not they can keep that information, and prevent them from selling it.
Talk about a power shift! Not only are we as consumers shaping the public perception of brands through CX feedback in reviews and social commentary, we now have significant control over the way in which brands use what they know about us to market their products and services.
It’s important that businesses understand the impact of the CCPA, even if they are not directly affected by it. As privacy legislation such as the CCPA takes hold, businesses will have to rely less on advertising and more on the customer experience to win and keep loyal customers.
First GDPR, Now This?
You probably remember the all hubbub around the General Data Protection Regulation (GDPR) when it was introduced in May, 2018 in Europe. Although GDPR was a huge step forward toward preventing companies from selling the consumer data they collect, it had its critics.
And companies affected by the law lamented the time and cost of compliance, as well as the potential fines that could be levied against them if they failed to comply: A business can pay up to $23.5 million, or 4% of their global annual revenue.
But these high-stakes consequences have forced EU companies to take cybersecurity very seriously — and that much is a good thing.
Well, news travels fast, far and wide, and California lawmakers wasted no time in devising their own approach to protecting consumers’ data in the CCPA. California is the world’s fifth largest economy, so what happens there may very well influence similar legislation across the U.S.
Frequent, massive security breaches and an influx of massive amounts of consumer data have fueled the need for these new data privacy laws. More than 90% of the world’s data appeared in just the past two years and most of it has been collected without consumers’ permission. The data is generated by all of the cool technology we love — that Fitbit on your wrist, your trusty personal digital assistant, or the forms you fill out to receive offers and content online. Much of the data has been used for marketing and sales, and sold by data aggregators to third parties at a high price. Larger companies that can afford to balance interests of speed and innovation against stronger consumer privacy protection should be doing so, I believe.
Unfortunately, new ways in which our data is being used — sometimes against us — has raised fundamental questions about the ethics of data use and the importance of data privacy. For example, in China, personal data is used by the government to monitor citizens’ “trustworthiness” with respect to its criticism and compliance with China’s implicit social norms. They even use the data to regulate people’s behavior and in many cases restrict their rights. It’s common knowledge that data is being used to persuade us how to vote — who hasn’t received a flurry of political ads on Facebook and other social channels in the last year?
These examples underscore the importance of holding larger companies and governments accountable for how they use consumer and personal data. Although neither the GDPR or the CCPA is perfect, the new laws provide consumers some peace of mind. Moreover, they help corporations avoid the financial impact of data breaches and build trust with customers. In fact, customers may be more willing to share their data if they trust that the environment is secure and that companies aren’t going to use their data in any unauthorized way.
With the CCPA, the Consumer’s in Charge
Although the two laws are quite similar, the CCPA differs from the GDPR in a few important ways:
- Business impacted: Whereas businesses of any size must comply with the GDPR, the CCPA only impacts businesses that reach a certain size who process a certain amount of data.
- Fines: GDPR fines are capped based on a business’s annual revenue, whereas CCPA fines have no ceiling and are assessed per violation.
- Opt-in/Opt-out: Under the GDPR, businesses must have opt-in from consumers prior to collecting data, whereas with CCPA, consumers must opt-out of data collection.
- Third-party data sales: Under GDPR, businesses must have consent from customers before and third-party processing or sales of data, while the CCPA requires businesses to simply notify the customer of a data sale or transfer and give them the opportunity to stop it.
In short, CCPA actually puts consumers in the driver’s seat. It’s up to consumers to take action if they want their data to remain private — but businesses are required to heed their requests.
Data Privacy Laws Will Give CX More Weight
Today’s consumers exercise a lot of control over how companies attract and retain business. In addition to having more control over the use of their personal data, they help to shape a company’s brand image and reputation by speaking their minds and sharing their experiences online. And as more states enact CCPA-like legislation, businesses will lose access to personal data for profiling and targeting — along with their power to persuade audiences with highly targeted advertising and other traditional marketing tactics.
To continue to attract and convert business, companies, especially larger ones, will need to hone their skills around delivering exceptional CX, and do a better job of engaging with consumers on their terms.