Skip to main content

On-demand webinar coming soon...

Blog

CCPA toll-free number requirement

Certain businesses under CCPA jurisdiction must provide consumers with a toll-free number to make requests. Learn more about what this means for your organization

Param Gopalasamy, CIPP/E, CIPM
Content Marketing Specialist, OneTrust

December 15, 2022

photo of a man in his 20s with a backpack walking up a set of stone stairs outside while talking on a phone.

The California Consumer Privacy Act (CCPA) entered force on January 1, 2020, which had immediate effects on the relationships between consumers, businesses, and personal data. 

The toll-free number requirement was introduced to ensure that businesses are always reachable and transparent to their website users, giving them the option to call and use their rights around privacy and data protection.

The California Privacy Rights Act (CPRA), going into effect on Jan 1, 2023, follows up the CCPA with new and expanded consumer and employee privacy protections, retaining the toll-free number requirement as well. 

What businesses are required to provide a toll-free number?

An amendment to the law, confirmed in October 2019 by the Governor of California, modified a key provision. Referred to as the “toll-free number amendment”, it clearly defined which types of businesses must provide a toll-free phone number for consumers to exercise their privacy rights.

According to the amendment (AB-1564), businesses that operate primarily in-person but also have a web presence must be capable of processing consumer rights requests requests to know through a minimum of three channels. Such organizations must make at least the following methods readily available to consumers: 

  • A web form 
  • A toll-free phone number  
  • A paper form

Businesses operating in-person without a website must also offer a minimum of two request methods to consumers:

  • A toll-free phone number 
  • A paper form submitted in person and/or by mail

 

What businesses are exempt from providing a toll-free number?

AB-1564 changed the request method obligations for web-based businesses. If a company has direct relationships with consumers and operates exclusively online, it does not have to provide a toll-free phone number. Instead, the business must provide at least the following online contact methods to receive and process consumer rights requests:

  • An email address  
  • A web form 

Note that businesses also provide at least two methods to support the right to delete personal information. The channels listed above fulfill these requirements. 

A toll-free phone number is always an acceptable option, regardless of where the business primarily operates, so long as the fundamental requirements are met. 

What does the CCPA toll-free number requirement mean for businesses?

If a company doesn’t meet the exemption enacted by AB-1564 for web-based businesses, it must provide at least two ways for consumers to submit requests for information and requests to delete. For many businesses, those methods will include a toll-free number and web form conspicuously linked on the company’s website.

When handling requests coming in through the toll-free channel, the following steps should ensure that these requests are processed efficiently. 

  1. Keep records of each request that comes through the toll-free number, categorizing them based on the type of request (know, access, deletion, portability) 
  2. When each call comes through, have two to three ways to reasonably determine the customer’s identity based on the data you have (phone number, address, account number, etc.) 
  3. In case these requests require action to be taken on the customer’s side, use the phone call to establish a channel through email, and complete processing the request there. 
  4. Maintain a database of requests that have started through the toll-free channel, with data on whether they were resolved by phone or needed to be taken online to resolve. 

 

How can my business comply with the toll-free number requirement?

Compliance with the CCPA’s toll-free requirement is easier with the OneTrust CCPA suite of automated privacy management and data governance tools. 

The OneTrust CCPA Toll-Free Number feature enables businesses to integrate a phone-based workflow into an automated consumer rights process. Use it to generate a unique or shared phone number, greet callers with a customized message, and verify consumer identities to log requests effectively.

With OneTrust CCPA Toll-Free Number, you can:

  • Publish a toll-free phone number to satisfy legal requirements  
  • Set up a customized welcome greeting that aligns with your company’s messaging and CCPA/CPRA requirements 
  • Replace manual processing tasks, such as identity verification, with automated ones 
  • Integrate with existing web-based workflows, such as CCPA Consumer Rights and Do Not Sell solutions 
  • Automate request fulfillment when integrated with OneTrust Data Discovery  
  • Log consumer requests in a centralized location for compliance recordkeeping

To learn more about how OneTrust can help with the CCPA toll-free requirement and other obligations under the CPRA, visit OneTrust CPRA and request a demo today.


You may also like

Webinar

Privacy Management

CPRA in action: OneTrust Live Demo

Join us for a deep dive tour of our suite of technology solutions for operationalizing and automating CPRA requirements across Do Not Share, Consumer Rights and privacy governance operations.

August 01, 2024

Learn more

Webinar

Privacy Management

Going beyond CCPA

Join us for an in-depth webinar on "Going Beyond CCPA," where we will explore the intricacies of privacy laws, compare major regulations, and provide guidance on enhancing your privacy policy.

July 25, 2024

Learn more

Webinar

Privacy Management

The evolution of CCPA

Join us for an insightful webinar on "The Evolution of CCPA" where we will delve into the latest amendments, understand their impact, and explore the new requirements and implications for businesses.

July 18, 2024

Learn more

Webinar

Privacy Management

Mastering data privacy: Navigating CCPA, CPRA, and beyond

Mastering Data Privacy: Expert Guidance on CCPA, CPRA, GDPR Compliance, Privacy Policy Best Practices, and Live Demo Insights

July 18, 2024

Learn more

Webinar

Consent & Preferences

Global Privacy Control: CCPA enforcement of GPC opt-out signals webinar

Watch this on-demand webinar to gain an overview of what Global Privacy Control (GPC) is, the benefits of the signal, and how it works.

October 30, 2022

Learn more

Webinar

Privacy Management

Employee vs. consumer rights: Same concept, different reality

Join this webinar to learn about the rights request fulfillment complexities introduced by the end of the employee exclusion in the CPRA.

August 25, 2022

Learn more

White Paper

Privacy & Data Governance

How OneTrust helps with California privacy law compliance (CCPA & CPRA)

This guide to California privacy law compliance helps your organization understand the requirements under the CCPA and CPRA.

June 23, 2022

Learn more

Webinar

Privacy & Data Governance

Know your laws: Comparing CCPA & CPRA vs. GDPR

Watch this free webinar and see how the CCPA and CPRA compare with the GDPR.

January 04, 2022

Learn more

eBook

Privacy & Data Governance

The ultimate guide to CCPA compliance

The Ultimate Guide to CCPA Compliance eBook highlights key compliance areas of  the CCPA that you should consider when building a privacy program.

December 01, 2021

Learn more

Webinar

Privacy Management

CCPA, CPRA, and Global Privacy Control: Moving toward a more private web

Watch this webinar to learn about Global Privacy Control (GPC), how it centralizes user opt-out preferences, and streamlines compliance with CCPA and CPRA. 

September 08, 2021

Learn more

Webinar

Privacy & Data Governance

Breaking update: New California Consumer Privacy Act

This webinar dives into the details of the California Consumer Privacy Act and how it will impact the companies handling their data.

July 23, 2021

Learn more

Infographic

Privacy & Data Governance

CCPA vs. CPRA infographic

Compare California's privacy laws: CCPA vs CPRA in this downloadable infographic.

July 22, 2021

Learn more

Infographic

Privacy Management

CDPA vs CCPA: Comparing US privacy laws

Download this infographic comparing the Virginia CDPA to the California CCPA.

July 22, 2021

Learn more

Webinar

Privacy & Data Governance

CPRA vs CCPA: What you need to know

Join us for a webinar as our legal experts discuss the key differences between the CPRA vs the CCPA.

July 22, 2021

Learn more

Webinar

Privacy Management

CCPA identity verification

In this webinar we explore options for verifying a consumer's identity and how to fully automate this process with OneTrust.

August 13, 2019

Learn more

Webinar

Privacy & Data Governance

CCPA compliance masterclass

Watch our OneTrust CCPA Masterclass Series and learn how to prepare your organization for CCPA compliance.

Learn more