Commenters on the final California Consumer Privacy Act (CCPA) regulations asked if a Vehicle Identification Number, even by itself, is personal information. Do you have to delete it? How do you address sharing of VINs with third parties for the purpose of an opt-out under CCPA?
The California Attorney General replies:
- Whether or not VIN by itself would be personal information is a fact-specific determination.
- Whether or not a VIN is exempt from the right to delete is a fact-specific determination.
Re opt-out:
VIN is included in the definition of “vehicle information” the sharing of which is addressed in CCPA (1798.145(g)).
[1798.145(g) it deals with: information retained or shared between a new motor vehicle dealer for the purpose of effectuating, or in anticipation of effectuating, a vehicle repair covered by a vehicle warranty or a recall under certain circumstances].
To the extent 1798.145(g) applies, it sets forth when the right to opt out does not apply to vehicle information.
[View source.]
