The California Consumer Privacy Act (CCPA) is taking effect on January 1st, 2020, and one requirement that still confuses many businesses is the Toll-Free Number requirement.
The CCPA requires businesses to have a toll-free number as a designated method for consumers to submit requests for information about the collection and selling or sharing of their personal information (i.e., information requests or the right to know). However, the California Governor signed an amendment to the Toll-Free Number requirement back in October, slightly changing the requirement’s scope. The amendment confirms that businesses must provide two methods for consumers to submit information requests, including, at a minimum, a toll-free number. However, businesses that operate exclusively online and have a direct relationship with the consumer need not provide a toll-free number; instead, they must only provide an email address as a designated method for submitting requests. And, businesses that maintain an internet website must provide the internet website to consumers to submit information requests.
The California Attorney General (AG) also laid out rules on the use of toll-free numbers in section § 999.312 of the proposed regulations. The AG’s draft regulations reiterate that businesses must provide two or more designated methods for consumers for submitting requests to know, including, at a minimum, a toll-free number.Where businesses operate websites, they must, at a minimum, also provide an interactive web form accessible through their websites or mobile apps. In addition, the AG rules permit businesses to use a toll-free number as one of two or more methods for submitting deletion requests.
In determining the appropriate methods for submitting information and deletion requests, businesses must consider how they primarily interact with consumers. So, for example, if the business has an online presence, but mainly interacts with consumers at a retail location, it must provide three methods to submit information requests—namely, a toll-free number, an interactive web form, and a physical (paper) form.
With respect to the right to opt-out of the sale of personal information, the proposed regulations require businesses to provide, at a minimum, an interactive web form accessible via the “Do Not Sell My Info” link. Other acceptable methods include:
At this point in time, the AG’s proposed regulations are not final and may undergo changes before the AG publishes the final regulations sometime in the Spring of 2020.