On May 29, 2019, Nevada became the first state to pass legislation emulating portions of the CCPA when it adopted Senate Bill No. 220.
While Senate Bill No. 220 incorporates the CCPA’s concept of permitting consumers to object to the sale by a company of their information, it avoids many of the drafting errors, ambiguities, and business impracticalities of the CCPA, including its treatment of online behavioral advertising.
For context, the California CCPA requires that a business that “sells” personal information disclose within its privacy policy a “list of the categories of personal information it has sold about consumers in the preceding 12 months.”1 The CCPA broadly defines the term “sell” as including the act of “disclosing” or “making available” personal information “for monetary or other valuable consideration.”2 “Personal information” is also defined broadly as including any information that “could reasonably be linked, directly or indirectly, with a particular consumer or household” such as, in certain instances, IP addresses, unique online identifiers, browsing history, search history and “information regarding a consumer’s interaction with an Internet Web site, application, or advertisement.”3 Plaintiffs’ attorneys are likely to argue that the act of authorizing a third party behavioral network to access information transmitted by a consumer is synonymous with “making available” the information and, thus, constitutes a “sale” pursuant to the CCPA. In order to mitigate the risk that permitting behavioral advertising networks to deploy cookies on a website will be interpreted as a “sale,” many websites are asking consumers for opt-in consent to the use of behavioral advertising cookies through cookie banners. The CCPA excepts from the definition of “sale” the situation where a “consumer uses or directs the business to intentionally disclose personal information.”4 As a result, if a website deploys a cookie banner, and a consumer agrees or “opts-in” to the use of tracking cookies, the website arguably has not “sold” information to behavioral advertisers.
Unlike the CCPA, Nevada defines the term “sale” as including only “the exchange of covered information for monetary consideration by the operator [of a website] to a person for the person to license or sell the covered information to additional persons.”5 Nevada’s narrower definition precludes the term from applying to the use of third party behavioral advertising networks as (1) behavioral advertising networks typically do not provide advertisers or publishers with “monetary consideration” for the deployment of their cookies, and (2) while the behavioral advertising networks may use the information that they obtain from their cookies for the benefit of themselves and their other clients, they typically do not “license or sell” that information.
For more information and resources about the CCPA visit http://www.CCPA-info.com.
This article is part of a multi-part series published by BCLP to help companies understand and implement the General Data Protection Regulation, the California Consumer Privacy Act and other privacy statutes. You can find more information on the CCPA in BCLP’s California Consumer Privacy Act Practical Guide, and more information about the GDPR in the American Bar Association’s The EU GDPR: Answers to the Most Frequently Asked Questions.
1. CCPA, § 1798.130(A)(5)(C)(i).
2. CCPA Section 1798.140(t)(1).
3. CCPA, Section 1798.140(o)(1)(A), (F).
4. CCPA, Section 1798.140(t)(2)(A).
5. S.B. 220 at § 1.6.
[View source.]
