Law Stack Exchange is a question and answer site for legal professionals, students, and others with experience or interest in law. It only takes a minute to sign up.
Sign up to join this community
I've been reading the documentation about CCPA, and from my understanding, if you don't sell users' data, you don't have to present an option to opt out.
But another part of CCPA is the ability for a user to see what data has been collected and to be able to delete their data. Does this only apply if you are selling the data, or does it apply regardless?
Yes, the right to know and the right to delete applies also when the data is not sold, assuming that no exception applies.
Indeed, the CCPA's right to opt out via the Do Not Sell My Personal Information mechanism (section 1798.135) only applies when the business “sells” the information (section 1798.120), where
“Sell,” “selling,” “sale,” or “sold,” means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to another business or a third party for monetary or other valuable consideration.
(section 1798.140(t))
The right to delete personal information does not have such a restriction (section 1798.105). It applies to all businesses that are subject to the CCPA. As the Attorney General explains in item E.5 of their CCPA FAQ, there are a couple of reasons why a deletion request might still be denied. Similarly, the right to know can also apply to data that is not sold, but can be denied for a similar set of reasons (see item C.5 in the FAQ).
The main caveat is that some aspects of the right to know only relate to the sale of information, and that a business that is not involved in the sale of personal information of California residents might not be subject to the CCPA at all – it would first have to exceed a gross annual revenue of USD 25 million (inflation-adjusted). But for a business that is subject to the CCPA (either due to crossing the revenue threshold or due to selling personal information), the CCPA rights apply to all personal information it processes, regardless of whether that information was involved in the sale.
