Having taken effect on January 1st of 2020, the California Consumer Privacy Act (CCPA) is widely regarded as one of the most expansive privacy laws in the United States to date. The CCPA places limitations on the collection and sale of a customer’s personal information, while also providing certain legal protections when it comes to that same personal information. But the CCPA isn’t just a US version of the EU’s General Data Protection Regulation (GDPR). While you won’t have to start all over if you’re prepared for GDPR, that doesn’t mean you have all your bases covered for CCPA. 

In this blog we’ll be covering the basics of the CCPA, how it compares with GDPR and some of the FAQ’s that have arisen around each and their implementation in US businesses working domestically and internationally.

Who does the CCPA apply to?

The CCPA applies to any business that satisfies one or more of the following conditions:

1. Does business in the state of California
2. And satisfies one of the following criteria:
   • Annual gross revenue in excess of $25 million;
   • Alone or in combination, annually buys, receives for the business’s commercial purposes, sells, or shares for commercial purposes, alone or in combination, the personal information of at least 50,000 consumers, households, or devices; or
   • Derives at least 50 percent of its annual revenues from selling consumers’ personal information.

The biggest differences between the GDPR and CCPA lie in the scope of the application, the extent of collection limitations and the rules around accountability for breaches and challenges for non-compliance. In this chart, you’ll see some of the subtle, but important differences between the GDPR and the CCPA.

Frequently Asked Questions

Does this apply to businesses not located in California? 

A business does not need to be located in the state of California to be subject to CCPA. This means any business that is ‘doing business’ via online transactions with California residents or has employees that live in the state.

Can companies be fined for non-compliance?  

The private right of action in the CCPA is limited to data breaches. Under the private right of action, damages can come in between $100 and $750 per incident per consumer. The California AG also can enforce the CCPA in its entirety with the ability to levy a civil penalty of not more than $2,500 per violation or $7,500 per intentional violation.

I don’t think we really collect personal information. Does the CCPA apply? 

CCPA has an extremely broad description of what constitutes personal information. If you collect resumes for job postings, your website tracks cookies or if you have a ‘Contact Us’ form on your website you are collecting personal information.

Is there an exemption for B2B businesses?

Sort of. B2B Companies are given a limited reprieve from complying with each of the requirements of the CCPA when it comes to the transactions and communications with other organizations, companies and government agencies. Personal information that is collected in the course of B2B communications or transactions from or about an employee, owner, director, officer or contractor of a business or government agency is exempt from most CCPA requirements. But this exemption will expire at the end of 2020. Even if your B2B company is not selling business contact information you still need to determine to what extent the information you collect for marketing purposes must comply with CCPA.

How to cover your bases?

The CCPA requires companies to keep detailed records of all personal information categories dating back to January 1, 2019. You should begin to inventory all the data you have collected since that date. You will also need to update your privacy notices and add a “Do Not Sell My Personal Information” link to your home page.

Additional Resources for Business Owners

Magento also provides an excellent, more detailed guide to making sure your site is GDPR and CCPA compliant. It is available here.

For an even greater in-depth review of the CCPA law, please consult this great article from the National Law Review.

While the CCPA has some restrictions that currently limit it to the state of California, there is little doubt that it will have reverberations across the US and the world. California is, after all, the 5th largest economy on earth. With something as complicated as this new law and as important as your business we recommend that you consult with your attorney to confirm if CCPA applies to your business before taking action on compliance.

The next decade could very well be defined by the continued proliferation and advancement of AI and Machine Learning and the data that process collects. Assuming that occurs, it certainly means that AI will have a major impact on all aspects of business. How will that all play out? Only time will tell. But there have been a number of recent developments in these fields that are blazing a trail toward rapid changes across the digital eCommerce landscape. Let’s take a look at a few of these developments.

Automated interactive personalization

In the modern world, consumers are inundated with hundreds, if not thousands of ads every single day. And as consumers continue to get barraged with messaging, they are going to become fatigued, if not completely unaffected by seeing generic ads. To combat this occurrence, AI-powered personalization will become more prevalent and grow in importance. Customers decide very quickly—in a matter of seconds—whether they like your marketing message. Provide something relevant and personal and you’ve got a satisfied customer. Miss the mark, however, and they’re gone. While many companies have been able to personalize with a few product lines or segments, most still struggle to scale this personalization across all the ways they engage with customers. Done right, personalization enhances customers’ lives and increases engagement and loyalty by delivering messages that are tuned to, and even anticipate, what the customers truly want. These personalizations for the customer translate into financial benefits for the companies who succeed in this effort. Personalization can reduce acquisition costs by as much as 50 percent, lift revenues by 5 to 15 percent, and increase the efficiency of marketing spend by 10 to 30 percent.

What is needed to execute this personalization pace at scale is the right automation technology. Assembling and operating a marketing-automation tech stack, however, can be a challenge. Magento extensions such as Klevu, dotDigital and Listrak have already begun this endeavor. By driving site search, on-site personalization, email, and remarketing. But it is going to be more of an SOP and a necessity as time goes by. Advances in technology, data, and analytics will soon allow marketers to create much more personal and “human” experiences across moments, channels, and buying stages. Physical spaces will be reconceived to include these new personalizations and improve the consumer experience. The new customer journey will be supported far beyond a brand’s front door. AI has been at the forefront, helping companies automate the ways in which they personalize their interactions with customers, thereby enabling companies to scale their operations. Examples of how AI and deep learning impact the customer experience include automating the removal of backgrounds in product images as well as automatically enabling videos originally shot in landscape mode to be delivered in portrait mode, which greatly improves the viewing on mobile phones.

Building a scalable, yet personalized customer experience remains at the heart of what every brand desires to create in the 2020’s. Experiences that harness the power of rich media, whether in the form of images or videos, are a significant driver behind this success. However, business and technology executives need to think through the complexities and implications of these efforts, at both a technical and customer impact level. Doing so, and doing so early on, will enable a more seamless delivery of the campaigns and experiences they desire.

Data & Analysis

Data analysis has changed dramatically since the start of the century and that evolution has only become more rapid and pronounced as we advance into the 2020’s. If you’re operating an eCommerce store, and/or employing any of the AI/Machine Learning developments we just discussed, you’re no doubt dealing with tens of thousands of points of data. Data that is now no longer relegated to just numbers. Data is now music, images, videos, downloadable files and more. Data is large, dispersed and in multiple formats. So, how will you organize and implement this data into your digital sales efforts in the future?

Cloud-Based – As data sets become larger and larger it will become more difficult to run the massive amount of necessary calculations on your local machine. This will create an entire market of cloud-based data services that, simply put, make analysis faster.

A/B Testing with AI – As we recently covered on our blog, A/B testing is only going to grow in importance and the technology being developed and in some cases already implemented is going to be more efficient and effective at A/B testing than any web designer or marketing manager. By way of review, A/B Testing is the altering of elements of your site to different, random visitors. These elements can include, but are not limited to, variations in the content, colors, images, copy, Calls-to-Action, and even prices. It is through A/B testing that you’re able to come up with the optimum combinations of website elements that will keep visitors engaged and making purchases. But rather than having an employee analyze the site, select which elements to alter and test, analyze the data and choose which tested elements to keep and which to remove, AI will be taking over all of these steps. There are already extensions like HiConversion that are currently available that will automatically run its own A/B tests to your pages, changing the elements based on visitor behavior. It will then provide recommendations based on these continual and evolving A/B tests. This AI-driven A/B testing will only become more advanced and more standard as the decade progresses, leaving fewer elements of your UX/UI to guessing or to the discretion of your team. Your real-world customers and website visitors are your greatest teachers and AI will learn directly from them more and more.

Smarter Marketing – But what to do with all of this customer information you’ve gathered? Quite simply, put it to work retaining your customers. With the personalization information you’ve received and the on-site data you’ve collected you can, for example, set up automated messages to reach segments of your customer base, no matter where they may be: Remind visitors of the contents of their abandoned cart via email, show them display ads that tie directly to pages that they’ve visited via remarketing, and use your A/B testing programs to deliver the most appealing and effective User Experience possible once they’ve returned to your site.

Check back next week for the second installment in our ‘What’s Next’ series, where we will be discussing Progressive Web Apps, Headless eCommerce and more.