The California Attorney General Sends First Notices of the CCPA Violations to Online Businesses
When the California Attorney warned that the CCPA enforcement will commence on July 1, 2020, he was not kidding. On July 9, 2020, the California Deputy Attorney General Stacey Schesser confirmed earlier reports that her Office sent 30-day warning notices to a number of companies over alleged violations of the statute. In issuing the notices, the Attorney General considered complaints received by the Office as well as complaints made publicly on social media.
Under the CCPA, the Attorney General can bring an action against a non-compliant business for up to $2,500 after the business has been given 30 days to cure the violation. For intentional violations, the penalties are far higher with a $7,500 cap. The CCPA fines are applied on a per violation basis as opposed to a per consumer basis and could add up rather quickly. If a business commits one violation under the CCPA across a 10 million customer base, that could amount to a potential $25 billion in fines. If you change this scenario to an intentional violation, the resulting penalty may be three times higher.
“The initial swath of letters looked at businesses that all operated online and had to come into compliance with respect to statements or mechanisms that they had to make available,” said Schesser. She added that businesses that sell consumers’ information, but do not have a “do not sell” link on their websites, as required by the CCPA, “should make sure to cure that as quickly as possible.”
The Attorney General’s Office has recently finalized the text of the CCPA Regulations, but they still remain under review by the state’s Office of Administrative Law, and therefore have no legal force. Accordingly, at this time, the Attorney General can enforce the CCPA only against the text of the Act itself rather than more detailed and technical Regulations.
Ask Clarip today how we can solve your biggest privacy compliance pain points, Call Clarip at 1-888-252-5653