In addition to the various amendments to the California Consumer Privacy Act (CCPA) passed by the California Legislature on September 13, the legislature also passed Assembly Bill 1202 (AB 1202). AB 1202 requires “data brokers” to register in a published directory maintained by the California Attorney General.

The law, which was supported by various consumer groups as a way to assist consumers in exercising the new rights granted by the CCPA, has a similarly broad scope and borrows many of its definitions directly from the CCPA. Assuming Governor Gavin Newsom signs the bill into law before the October 13, 2019 deadline, the California bill will become only the second such law in the United States, after Vermont.

Who Is Covered

AB 1202 defines “data broker” as “a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship.”

The bill’s definitions of “sale,” “personal information,” “business,” “collect,” “consumer” and “third party” expressly reference the definitions of those terms in the CCPA. As we covered in our client alert on the CCPA, those definitions are expansive, and the CCPA’s definition of “sale” reaches beyond what most businesses would typically consider to be a sale in the traditional sense.

The definition of “personal information” under the CCPA is similarly broad, defined as “information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.” This definition reaches beyond most state and federal statutory definitions of “personal information.”

AB 1202 does not define exactly what “direct relationship” means. The bill does state that a direct relationship with a consumer can be formed in various ways, including via the consumer’s visitation of the business’s premises or website or by the consumer having affirmatively and intentionally interacted with the business’s online advertisements.

Vermont’s data broker registration law, the only other such law in the United States, also defines “data broker” as requiring a “direct relationship” with a consumer. The Attorney General of Vermont has provided additional guidance on what it means to have a “direct relationship” under the Vermont law, stating that a business would be considered to have a direct relationship with past or present customers, clients, subscribers, users, registered users, employees, contractors, agents, investors and donors. On the other hand, the Vermont guidance states that “a business that collects information about consumers and then adds additional data elements, cleans up the data, or categorizes the data into lists in order to sell or license the data or a subset of the data to others, is a data broker.” Given the similarity of AB 1202 to Vermont’s statute, this guidance may help to define the likely scope of California’s law until, and if, further details emerge.

Requirements

AB 1202 will require data brokers to register with California’s Attorney General for a fee and provide the data broker’s name and primary physical, email and internet website addresses, as well as any additional information or explanation the data broker would like to provide. This information will be included on a publicly available directory. Failure to register by January 31 of each year will subject the data broker to injunction and civil penalties of $100 for each day the data broker has failed to register, plus any costs and expenses incurred by the Attorney General related to investigation or prosecution as determined appropriate by a court.

CCPA Nexus and Impact on Businesses

Ultimately, AB 1202 was passed to allow consumers to more easily exercise their rights of access, deletion and opt-out of sale as provided by the CCPA. In August 2019, various consumer rights organizations wrote a letter in support of AB 1202, outlining arguments in favor of the law that shed light on its impact on companies characterized as data brokers.

In the letter, the groups stated that this bill would increase the “visibility and accessibility of data brokers, [and] better enable consumers to exercise their privacy rights under the CCPA.”

In fact, AB 1202 is broader than Vermont’s data brokerage registration law. In borrowing the CCPA’s broad definitions of “sale” and “personal information,” among others, AB 1202 captures a broader pool of businesses and will have a deeper impact on companies that may not typically consider themselves “data brokers” in the traditional sense. Businesses required to register with the California Attorney General are likely to face a higher volume of consumer rights requests under the CCPA due to the increased visibility generated by the registry, and will also need to consider how to navigate the formal public characterization as a registered “data broker.”

Pepper Points

Similar to the recent amendments to the CCPA passed by the California Legislature, absent a veto from California’s governor, businesses will need to take steps to address the impact of AB 1202. We recommend that businesses:

• carefully review the sources of information they possess about individuals, especially given the broad definitions incorporated by the law and the lack of express guidance on the existence of a “direct relationship”

• assess their relationships with consumers and their data-sharing practices with third parties

• consult with counsel if the business may be considered a “data broker” under the law, and take steps to prepare for registration and compliance with the CCPA generally, including how the business will respond to any consumer rights requests it receives.