(1) Has annual gross revenues > $25 mil;
(2) Annually buys, sells, or shares personal information of 50,000 or more consumers or households; or
(3) Derives 50% or more annual revenues from selling personal information
(1) Processes personal data of 100,000 or more consumers during a calendar year; or
(2) Derives revenue or receives a discount on goods or services from the sale of personal data, and processes personal data of 25,000 or more consumers
(1) Processes personal data of 100,000 or more consumers during a calendar year; or
(2) Derives revenue or receives a discount on goods or services from the sale of personal data, and processes personal data of 25,000 or more consumers
(1) Controlled or processed personal data of 100,000 or more consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction; or
(2) controlled or processed personal data of 25,000 or more consumers and derived > 25% of gross revenue from the sale of personal data
(1) has annual revenue of $25,000,000 or more; and
(2) Controls or processes personal data of 100,000 or more consumers or derives > 50% of gross revenue from the sale of personal data and
controls or processes personal data of 25,000 or more consumers
- Mental/physical health condition or diagnosis
- Genetic/biometric information
Personal information pertaining to children is not defined as “sensitive,” but parental consent is required for the “sale” of personal information pertaining to children under 13, and teens under 16 must opt-in to a “sale” of their personal information
X
Personal data pertaining to children is not defined as “sensitive,” but controllers must comply with COPPA
X
X
X
X
X
X
X
X
X
X
X
X
X
X
Personal information pertaining to children is not defined as “sensitive,” but parental consent is required for the “sale” of personal information pertaining to children under 13, and teens under 16 must opt-in to a “sale” of their personal information
X
No, but right to limit use and disclosure of sensitive personal information
Consent required to process sensitive data, and consent from parent or guardian required to process sensitive data pertaining to a child
Consent required to process sensitive data, and consent from parent or guardian required to process sensitive data pertaining to a child
Consent required to process sensitive data, and consent from parent or guardian required to process sensitive data pertaining to a child (defers to COPPA)
Consent required to process personal data for targeted advertising or sell personal data if Controller has actual knowledge, and willfully disregards, that the consumer is 13-16 years of age
X
Controller must provide consumer with notice and right to opt-out of data collection
Children’s data is not defined as “sensitive,” but controllers must comply with COPPA
- Disclosure of personal data to a processor
- Disclosure of personal data to a third party to provide a product or service requested by a consumer
- Disclosure or transfer of personal data to an affiliate
- Disclosure of personal data as part of a merger, acquisition, bankruptcy, or similar transaction
- Disclosure of personal data at consumer’s direction or intentionally by consumer
- Disclosure of personal data to a processor
- Disclosure of personal data to a third party to provide a product or service requested by a consumer
- Disclosure or transfer of personal data to an affiliate
- Disclosure of personal data as part of a merger, acquisition, bankruptcy, or similar transaction
- Disclosure of personal data at consumer’s direction or intentionally by consumer
- Disclosure of personal data to a processor
- Disclosure of personal data to a third party to provide a product or service requested by a consumer
- Disclosure or transfer of personal data to an affiliate
- Disclosure of personal data as part of a merger, acquisition, bankruptcy, or similar transaction
- Disclosure of personal data at consumer’s direction or intentionally by consumer
- Disclosure of personal data to a processor
- Disclosure of personal data to a third party to provide a product or service requested by a consumer or a parent/guardian on behalf of a child
- Disclosure or transfer of personal data to an affiliate
- Disclosure of personal data as part of a merger, acquisition, bankruptcy, or similar transaction
- Disclosure of personal data at consumer’s direction or intentionally by consumer
Right to know categories, specific pieces of personal information collected, and categories of sources and parties with whom information is shared
Business must provide at least two methods for making requests, including toll-free number
Business must provide at least two methods for making requests, including toll-free number
X
Business must provide at least two methods for making correction requests, including toll-free number
X
- Opt-in consent for consumers under 16
- Parental consent for consumers under 13
- Provide at least two methods for requests
- Websites must include link to “Do Not Sell My Personal Information” page
Websites must include “Limit the Use of My Sensitive Personal Information” link in addition to “Do Not Sell or Share My Personal Information” link
Contemplates a user-selected universal opt-out mechanism effective 7/1/2024
Methods employed to allow consumers to exercise their rights must include a website link to a page that enables a consumer or agent to opt-out of targeted advertising or a sale of personal data
No later than 1/1/2025, Controllers must allow consumers to opt-out of targeted advertising or a sale of personal data through an opt-out preference signal sent, with a consumer’s consent, by a platform, technology, or mechanism indicating the intent to opt-out
Data should be provided in a format easily understandable to the average consumer, and to the extent technically feasible, in a structured, commonly used, machine-readable format
Opt-Out Requests: Respond within 15 business days
X
X
Agent can invoke right to opt-out of a sale, targeted advertising, or profiling
X
X
Parental consent is not required for the collection of personal information from children, but parental consent is required for the “sale” of personal information pertaining to children under 13, and teens under 16 must opt-in to a “sale” of their personal information
Defers to COPPA
Defers to COPPA
Requires contracts between Businesses and Service Providers
New defined term of “Contractor” and new requirements for contracts between Businesses and Contractors
Requires contracts between Controllers and Processors
Requires contracts between Controllers and Processors
Requires contracts between Controllers and Processors
Requires contracts between Controllers and Processors
At least 24 months
X
X
X
X
X
X
Only in the event of a security breach that compromises “personal information” (as that term is defined in a separate California data breach notification law)
Extends CCPA private right of action to breach of a username and password that permits access to an account
X
X
X
X
Source link
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
English
简体中文
Français
Latin
Português
Español
You must log in to post a comment.