California Code of Regulations › Title 11 - Law › Division 6 - California Privacy Protection Agency › Chapter 1 - California Consumer Privacy Act Regulations › Article 1 - General Provisions › Section 7001 - Definitions

Current through Register 2024 Notice Reg. No. 28, July 12, 2024
In addition to the definitions set forth in Civil Code section
					 1798.140, for
					 purposes of these regulations:
(a) "Agency"
				  means the California Privacy Protection Agency established by Civil Code section
				  1798.199.10
et seq.
(b)
				  "Alternative Opt-out Link" means the alternative opt-out link that a business may
				  provide instead of posting the two separate "Do Not Sell or Share My Personal
				  Information" and "Limit the Use of My Sensitive Personal Information" links as set
				  forth in Civil Code section
				  1798.135,
				  subdivision (a)(3), and specified in section
				  7015.
(c) "Attorney General" means the California
				  Attorney General or any officer or employee of the California Department of Justice
				  acting under the authority of the California Attorney General.
(d) "Authorized agent" means a natural person or a
				  business entity that a consumer has authorized to act on their behalf subject to the
				  requirements set forth in section
				  7063.
(e) "Categories of sources" means types or
				  groupings of persons or entities from which a business collects personal information
				  about consumers, described with enough particularity to provide consumers with a
				  meaningful understanding of the type of person or entity. They may include the
				  consumer directly, advertising networks, internet service providers, data analytics
				  providers, government entities, operating systems and platforms, social networks,
				  and data brokers.
(f) "Categories of
				  third parties" means types or groupings of third parties with whom the business
				  shares personal information, described with enough particularity to provide
				  consumers with a meaningful understanding of the type of third party. They may
				  include advertising networks, internet service providers, data analytics providers,
				  government entities, operating systems and platforms, social networks, and data
				  brokers.
(g) "CCPA" means the California
				  Consumer Privacy Act of 2018, Civil Code sections
				  1798.100
et
				  seq
.
(h) "COPPA" means the
				  Children's Online Privacy Protection Act,
				  15 U.S.C. sections
				  6501 to
				  6506 and
				  16 Code of Federal Regulations part
				  312.
(i) "Disproportionate effort"
				  within the context of a business, service provider, contractor, or third party
				  responding to a consumer request means the time and/or resources expended by the
				  business, service provider, contractor, or third party to respond to the
				  individualized request significantly outweighs the reasonably foreseeable impact to
				  the consumer by not responding, taking into account applicable circumstances, such
				  as the size of the business, service provider, contractor, or third party, the
				  nature of the request, and the technical limitations impacting their ability to
				  respond. For example, responding to a consumer request to know may require
				  disproportionate effort when the personal information that is the subject of the
				  request is not in a searchable or readily-accessible format, is maintained only for
				  legal or compliance purposes, is not sold or used for any commercial purpose, and
				  there is no reasonably foreseeable material impact to the consumer by not
				  responding. By contrast, the impact to the consumer of denying a request to correct
				  inaccurate information that the business uses and/or sells may outweigh the burden
				  on the business, service provider, contractor, or third party in honoring the
				  request when the reasonably foreseeable consequence of denying the request would be
				  the denial of services or opportunities to the consumer. A business, service
				  provider, contractor, or third party that has failed to put in place adequate
				  processes and procedures to receive and process consumer requests in accordance with
				  the CCPA and these regulations cannot claim that responding to a consumer's request
				  requires disproportionate effort.
(j)
				  "Employment benefits" means retirement, health, and other benefit programs,
				  services, or products to which consumers and their dependents or their beneficiaries
				  receive access through the consumer's employer.
(k) "Employment-related information" means
				  personal information that is collected by the business about a natural person for
				  the reasons identified in Civil Code section
				  1798.145,
				  subdivision (m)(1). The collection of employment-related information, including for
				  the purpose of administering employment benefits, shall be considered a business
				  purpose.
(l) "Financial incentive" means
				  a program, benefit, or other offering, including payments to consumers, for the
				  collection, retention, sale, or sharing of personal information. Price or service
				  differences are types of financial incentives.
(m) "First party" means a consumer-facing business
				  with which the consumer intends and expects to interact.
(n) "Frictionless manner" means a business's
				  processing of an opt-out preference signal that complies with the requirements set
				  forth in section
				  7025, subsection (f).
(o) "Information practices" means practices
				  regarding the collection, use, disclosure, sale, sharing, and retention of personal
				  information.
(p) "Nonbusiness" means a
				  person or entity that does not meet the definition of a "business" as defined in
				  Civil Code section
				  1798.140,
				  subdivision (d). For example, non-profits and government entities are nonbusinesses
				  because "business" is defined, among other things, to include only entities
				  "organized or operated for the profit or financial benefit of its shareholders or
				  other owners."
(q) "Notice at
				  Collection" means the notice given by a business to a consumer at or before the
				  point at which a business collects personal information from the consumer as
				  required by Civil Code section
				  1798.100,
				  subdivisions (a) and (b), and specified in these regulations.
(r) "Notice of Right to Limit" means the notice
				  given by a business informing consumers of their right to limit the use or
				  disclosure of the consumer's sensitive personal information as required by Civil
				  Code sections
				  1798.121 and
				  1798.135 and
				  specified in these regulations.
(s)
				  "Notice of Right to Opt-out of Sale/Sharing" means the notice given by a business
				  informing consumers of their right to opt-out of the sale or sharing of their
				  personal information as required by Civil Code sections
				  1798.120 and
				  1798.135 and
				  specified in these regulations.
(t)
				  "Notice of Financial Incentive" means the notice given by a business explaining each
				  financial incentive or price or service difference as required by Civil Code section
				  1798.125,
				  subdivision (b), and specified in these regulations.
(u) "Opt-out preference signal" means a signal
				  that is sent by a platform, technology, or mechanism, on behalf of the consumer,
				  that communicates the consumer choice to opt-out of the sale and sharing of personal
				  information and that complies with the requirements set forth in section
				  7025, subsection (b).
(v) "Price or service difference" means
(1) any difference in the price or rate charged
				  for any goods or services to any consumer related to the collection, retention,
				  sale, or sharing of personal information, or
(2) any difference in the level or quality of any
				  goods or services offered to any consumer related to the collection, retention,
				  sale, or sharing of personal information, including the denial of goods or services
				  to the consumer.