As the CCPA’s effective date approaches, businesses are actively monitoring how companies will update their privacy notices to comply with the new disclosure requirements of the Act. While many companies are prepared to update their own privacy notices at the end of the year, policies that are preemptively changed before year-end are being reviewed and scrutinized by the industry for trends and signs of any industry standard practices surrounding such things as the disclosure of the “sale” of information or the collection of information by “enumerated category.”
In order to help companies understand and benchmark emerging industry practice, BCLP analyzed a random sample of the privacy notices of Fortune 500 companies and will continue to monitor each week how the sample-set evolves and changes as January 1, 2020 approaches and thereafter.1 The following summarizes the “state” of privacy notice revisions as of the week of December 2, 2019:
|
Percentage of businesses that updated their privacy notices for the CCPA
|
Percentage of businesses that have a “Do Not Sell My Personal Information” button or link2
|
Percentage of businesses that disclose access rights for Californians (or for all data subjects)3
|
Percentage of businesses that disclose deletion rights for Californians (or for all data subjects)4
|
Percentage of businesses that provide a toll-free number to exercise their rights5
|
Percentage of businesses that provide an email address to exercise their rights6
|
|
16.6%
|
3.33%
|
60%
|
46%
|
36%
|
53%
|
1. Using a computer random number generator, BCLP selected 6% of the companies listed among the Fortune 500 in 2019. Revenues for the selected companies ranged from $85 billion to $5 billion. While BCLP did not conduct statistical analysis to determine whether the sample selected accurately represented the range of businesses in the United States, the sample contained companies focused on retail, financials, food, agriculture, manufacturing, entertainment, and energy.
2. In the event that a business sells personal information (as those terms are defined within the CCPA), the Act requires businesses to include a link on their homepage and in their online privacy notice titled “Do Not Sell My Personal Information.” Cal. Civil Code § 1798.135(a)(1), (2)(A).
3. Cal. Civil Code 1798.130(a)(5)(A).
4. Cal. Civil Code 1798.130(a)(5)(A); Cal. Civil Code 1798.105(b).
5. Cal. Civil Code 1798.103(a)(1).
6.
[View source.]
