Ccpa Cpra Compliance

CCPA/CPRA Compliance

Overview

The California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), establishes comprehensive consumer privacy rights under California Civil Code §1798.100-199. The CPRA, approved by voters on November 3, 2020 (Proposition 24), substantially amended the CCPA effective January 1, 2023, with a lookback period to January 1, 2022. The California Privacy Protection Agency (CPPA) was established as the first dedicated state privacy enforcement agency in the United States.

The CPRA replaced the California Attorney General as the primary enforcement body with the CPPA, added the category of sensitive personal information, created new consumer rights (correction and limit use of sensitive PI), expanded the definition of "sharing" for cross-context behavioral advertising, and introduced requirements for data processing agreements.

Applicability (§1798.140(d))

A business is subject to CCPA/CPRA if it:

1. Has annual gross revenues exceeding $25,000,000 in the preceding calendar year (adjusted by the CPPA for inflation starting January 1, 2024)
2. Annually buys, sells, or shares the personal information of 100,000 or more consumers or households (CPRA increased from 50,000)
3. Derives 50% or more of its annual revenues from selling or sharing consumers' personal information

Liberty Commerce Inc. Assessment: Liberty Commerce Inc., with annual revenues of $48 million and processing personal information of approximately 320,000 California consumers through its e-commerce platform, meets threshold (1) and threshold (2). Liberty Commerce Inc. is classified as a "business" under §1798.140(d).

Key Definitions

Personal Information (§1798.140(v))

Information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Categories include:

Sale (§1798.140(ad))

Selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer's personal information by the business to a third party for monetary or other valuable consideration.

Sharing (§1798.140(ah)) — Added by CPRA

Sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating a consumer's personal information by the business to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, including situations where no money is exchanged.

Service Provider vs. Contractor (§1798.140(ag), §1798.140(j))

Consumer Rights

1. Right to Know (§1798.100, §1798.110, §1798.115)

Consumers may request that a business disclose:

• Categories of PI collected
• Categories of sources
• Business or commercial purpose for collecting, selling, or sharing
• Categories of third parties to whom PI is disclosed
• Specific pieces of PI collected about the consumer

Lookback period: 12 months preceding the request (business may voluntarily go beyond).

Liberty Commerce Inc. Implementation: Liberty Commerce Inc. provides a "Know My Data" portal at privacy.libertycommerce.com/know where verified consumers can request all five categories of disclosure. The system generates a structured report in machine-readable format (JSON) and human-readable format (PDF) within 10 business days.

2. Right to Delete (§1798.105)

Consumers may request deletion of personal information collected from them. Upon receiving a verified request, the business must delete the PI and direct service providers and contractors to delete the consumer's PI.

Exceptions (§1798.105(d)): Transaction completion, security, error repair, free speech (Cal. Civ. Code §1798.105(d)(4)), internal uses reasonably aligned with consumer expectations, compliance with legal obligation, internal uses compatible with the context of collection.

Liberty Commerce Inc. Implementation: Liberty Commerce Inc. processes deletion requests through a cascading deletion workflow that propagates to all service providers (payment processor, shipping partner, analytics provider) within 45 calendar days. Retained data for legal compliance (tax records per 26 U.S.C. §6001) is documented with the specific legal basis.

3. Right to Correct (§1798.106) — Added by CPRA

Consumers may request correction of inaccurate personal information. The business must use commercially reasonable efforts to correct the information.

Liberty Commerce Inc. Implementation: Liberty Commerce Inc. allows consumers to self-correct profile data (name, address, email, phone) directly in their account. For data in backend systems (purchase history corrections, loyalty points), verified requests are processed through the privacy team with documentation of the correction.

4. Right to Opt-Out of Sale/Sharing (§1798.120)

Consumers have the right to direct a business that sells or shares their personal information to stop selling or sharing that information. The business must respect this direction.

Key requirements:

• "Do Not Sell or Share My Personal Information" link on homepage
• Must honor Global Privacy Control (GPC) signals as valid opt-out requests (CPPA Regulations §7025)
• No re-solicitation for 12 months after opt-out
• Must not discriminate against consumers who opt out (§1798.125)

Liberty Commerce Inc. Implementation: Liberty Commerce Inc. displays a persistent "Do Not Sell or Share My Personal Information" link in the footer of every page. The system detects GPC signals via the Sec-GPC: 1 HTTP header and navigator.globalPrivacyControl JavaScript API, automatically applying opt-out status to the browsing session and associating it with the consumer's account if authenticated.

5. Right to Limit Use of Sensitive PI (§1798.121) — Added by CPRA

Consumers may direct a business to limit its use of sensitive personal information to specified purposes (performing services/providing goods, preventing security incidents, resisting malicious/deceptive actions, ensuring safety, short-term transient use, performing services on behalf of the business, verifying/maintaining quality, upgrading/enhancing services).

Liberty Commerce Inc. Implementation: Liberty Commerce Inc. displays a "Limit the Use of My Sensitive Personal Information" link adjacent to the opt-out link. When activated, the system restricts processing of sensitive PI categories (precise geolocation, racial/ethnic origin data from surveys, payment card details beyond transaction processing) to the enumerated permitted purposes.

6. Right to Non-Discrimination (§1798.125)

A business may not discriminate against a consumer for exercising their CCPA rights, including by:

• Denying goods or services
• Charging different prices or rates
• Providing a different level or quality of goods or services
• Suggesting that the consumer will receive a different price or quality

Financial incentive programs are permitted if the consumer is notified and opts in, the incentive is reasonably related to the value of the consumer's data, and the business can explain the valuation methodology.

Business Obligations