DocumentationCustomer Success ManualQuestions?Go to Outgrow.co

Outgrow & California Consumer Privacy Act (CCPA) Compliance

Suggest Edits

California Consumer Privacy Act or AB 375 is a bill intended to enhance privacy rights and consumer protection for residents of California, USA. Ab 375 allows any California consumer to demand to see all the personal information a company has saved on them, as well as a full list of all the third parties that data is shared with.

What is Personal Data in accordance with CCPA?

As per CCPA following information related to an individual is considered as Personal Information:

1. Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier IP address, email address, account name, Social Security number, driver’s license number, passport number, or other similar identifiers.

2. Characteristics of protected classifications under California or federal law.

3. Commercial information including records of personal property, products or services purchased, obtained or considered, or other purchasing or consuming histories or tendencies.

4. Biometric information.

5. Internet or other electronic network activity information including, but not limited to, browsing the history, search history and information regarding a consumer’s interaction with a website, application or advertisement.

6. Geolocation data.

7. Audio, electronic, visual, thermal, olfactory or similar information.

8. Professional or employment-related information.

9. Education information, defined as information that is not publicly available personally identifiable information (PII) as defined in the Family Educational Rights and Privacy Act (20 U.S.C. section 1232g, 34 C.F.R. Part 99).

10. Inferences are drawn from any of the information identified in this subdivision to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, preferences, predispositions, behavior, attitudes, intelligence, abilities, and aptitude.

📘

IMPORTANT NOTE

CCPA does not consider Publicly Available Information as personal.

Consumers rights under CCPA

Consumer rights under the CCPA are as follows:

1. Disclosure: A business must disclose the personal information collected, sold, or disclosed for a business purpose about a consumer. A business that collects personal information needs to disclose, in response to a verifiable consumer request, the following:

  • Categories of personal information the business has collected about the consumer.
  • Categories of sources from which the personal information is collected.
  • Business or commercial purpose for collecting or selling personal information.
  • Categories of third parties with which the business shares personal information.
  • Specific pieces of personal information the business has collected about the consumer.

A business that sells a consumer's personal information or discloses a consumer's personal information for a business purpose needs to disclose the following in response to a verifiable consumer request:

  • Categories of personal information the business has collected about the consumer.
  • Categories of personal information the business has sold about the consumer and categories of third parties to which the personal information was sold by category or categories of personal information for each third party to which the personal information was sold (if the business has not sold consumers' personal information, it shall disclose that fact).
  • Categories of personal information the business has disclosed about the consumer for a business purpose (if the business has not disclosed consumers' personal information for a business purpose, it shall disclose that fact).

2. Access: A business that collects a consumer's personal information must, at or before the point of collection, inform the consumer as to the categories of personal information to be collected and the purposes for which the categories of personal information shall be used. A business must disclose and deliver the personal information the business collected about the consumer in response to a verifiable consumer request.

3. Deletion: A business must delete the personal information the business collected about a consumer and direct service providers to delete the consumer's personal information in response to a verifiable consumer request, subject to certain exceptions.

4. Anti-discrimination: A business must not discriminate against a consumer who exercises any of the consumer's rights under the CCPA. However, a business may charge different prices or provide a different quality of goods or services if the difference is reasonably related to the value provided to the consumer by the consumer's data and may offer financial incentives to a consumer for the collection, sale, or deletion of personal information on a prior opt-in consent basis.

5. Opt-Out and Website Requirements: A business that sells consumers' personal information to third parties needs to provide notice to consumers thereof and that consumers have the right to opt-out of the sale of their personal information. A business must provide a "Do Not Sell My Personal Information" link on its Internet homepage that links to an Internet webpage that enables a consumer to opt-out of the sale of the consumer's personal information. A business must not sell the personal information of consumers if the business has actual knowledge that the consumer is less than 16 years of age, unless the consumer, in the case of consumers between 13 and 16 years of age or the consumer's parent or guardian, in the case of consumers who are less than 13 years of age, has affirmatively authorized the sale of the consumer's personal information.

6. Privacy Policy Requirements: A business must describe in its online privacy policy or in any California-specific description of consumer privacy rights the following, which must be updated at least once every 12 months.

  • Consumers' rights under the CCPA, including the consumer right to opt-out of the sale of the consumer's personal information and a separate link to the "Do Not Sell My Personal Information" Internet Web page.
  • The methods for submitting consumer requests.
  • A list of the categories of personal information that the business has collected about consumers sold about consumers and disclosed about consumers for a business purpose in the preceding 12 months.

Collection & Usage of Personal Information

When you join us as a user of our Services, we ask for information that will be used to activate your account, provide the Services to you, communicate with you about the status of your account, and for other purposes set out in this Privacy Policy. Your name, company name, address, telephone number, email address, credit card information and certain other information about you may be required to provide the Services or disclosed by you during your use of the Services. You will also be asked to create a private password, which will become part of your account information.

By providing information to us and by retaining us to provide you with the Services, you voluntarily consent to the collection, use, and disclosure of such information as specified in this Privacy Policy. Without limiting the foregoing, we may on occasion ask you to consent when we collect, use, or disclose your information in specific circumstances. Sometimes your consent will be implied through your conduct with us if the purpose of the collection, use or disclosure is obvious and you voluntarily provide the information.

User Choice & Consent

Where required by law, Outgrow obtains consent from individuals and uses that consent as the basis for the processing of PII, including to collect, use, retain, or disclose such data. Individuals are given the choice to opt-in or opt-out of this procedure.

For all contact or data forms hosted on Outgrow, if required by the user and the law of the concerned geography, the user is allowed to add opt-in widgets with clear data privacy statements for the end user’s preference. When required, opt-out widgets can also be added by the user.

Also, Outgrow’s double opt-in feature allows you to obtain consent from individuals twice, once when filling out the form and the second opt-in can be handled via email confirmation, where the user receives an email confirming their interest in joining your email list.

📘

IMPORTANT NOTE

Outgrow is subject to the investigatory and enforcement powers of the United States Federal Trade Commission & California Attorney General. Dispute resolution will be conducted as per the regulations specified under Section 1798.150 and Section 1798.155 of the Civil Code. If you have any questions or suggestions regarding our CCPA compliance, please contact any of the below-mentioned individuals from our team at Outgrow:

Updated over 3 years ago