The CCPA is here! Now what?

Sebastian Zimmeck — Wed, 08 Jan 2020 12:57:40 +0000

Note: If you are an iOS Swift developer, we would love to hear what you think of our new privacy policy generator, PrivacyFlash Pro. Let us know!

On January 1, 2020 the CCPA became effective and will be enforced by the California Attorney General beginning July 1, 2020. What is the CCPA? It is a privacy law that gives California residents new privacy rights. Particularly, app and web developers should take note of the CCPA. The CCPA is the reason for many e-mails that you may have received recently from online services notifying you of a change to their privacy practices and policies.

Why does the CCPA matter to developers?

The CCPA is applicable to developers of mobile apps, web apps, and other online services that are doing business in California and that satisfy one or more of the following thresholds:

Annual gross revenues in excess of twenty-five million dollars
Processing for commercial purposes the personal information of 50,000 or more consumers, households, or devices
50 percent or more of annual revenues from selling consumers' personal information

For the CCPA to be applicable the developer does not need to be in California. Rather, it matters where the consumers reside. If an app is used by California residents, it may be subject to the CCPA (assuming that all other requirements for the applicability of the CCPA are met). Microsoft and a few other tech companies decided to apply the CCPA to all residents of the United States, which avoids the hassle of identifying where users reside.

It is not clear at this point whether the thresholds only relate to consumers residing in California or to all users of an app. For example, is the threshold of 50,000 or more consumers, households, or devices met if an app has more than 50,000 users in total but less than 50,000 from California? A conservative approach would be to assume that it relates to all users of an app and apply the CCPA.

Here is an important point. "Selling" is broadly defined in the CCPA and includes renting, releasing, making available, transferring, or otherwise communicating by electronic means a consumer's personal information for monetary or other valuable consideration. "Selling" will likely be interpreted to cover sharing of personal information with ad networks to target advertising for ad revenue.

"Personal information" is also broadly defined in the CCPA. It generally covers all information related to a consumer's interaction with an app. For example, advertising identifiers, IP addresses, and location information all qualify as personal information per the CCPA. Under this definition almost every app will process some category of personal information.

The bottom line is that the CCPA is applicable to many more developers than it initially seems. Likely, many smaller and mid-sized developers will be impacted by the heightened compliance standards the law mandates. It will take some time to settle under which circumstances the new law will apply. It may also lead some developers to change their business models, e.g., monetizing via in-app purchases instead of ad targeting to avoid the sale of personal information, which requires a "Do Not Sell My Personal Information" link under the CCPA.

Which rights do consumers have under the CCPA?

If the CCPA is applicable to an app, California residents have the right to request from the developer:

A copy of their personal information (right to know)
Deletion of their personal information (right to delete)
Being opted out from the sale of personal information (right to opt out)

Developers have to establish a process for users to submit such rights requests. The proposed CCPA regulations advise to set up an online web form for making requests. A link to this web form should also be included in the app's privacy policy.

An important (and not yet fully resolved) part of the rights request process is the identity verification of the individual submitting a request. Personal information should not be disclosed to unauthorized individuals. How the identity of the requester can be verified depends on what information an app is collecting in the first place: for example, if it collects ad IDs, developers can ask for this identifier; if it collects e-mail addresses, users should submit their rights requests from those e-mail addresses. Generally, developers should not ask for more information than they already have. Also, the more sensitive the personal information is, the higher the standard for identity verification should be.

To honor opt out requests, developers have to stop collecting personal information from the opted out users. In addition, they also have to notify third parties to stop such collection. For requests to delete, past information must be removed as well; again, both from the databases of the developer and any third party to whom such information was disclosed. Many ad networks have established processes for propagating rights requests through their systems, e.g., for AdMob publishers can restrict data processing. Developers should check which processes the third parties they integrate have set up and follow those. In the absence of any special processes provided, it is a good idea to just reach out to the third parties. Industry organizations have established compliance frameworks as well, e.g., the Interactive Advertising Bureau CCPA Compliance Framework.

What is the "Do Not Sell My Personal Information" link?

A key feature established by the CCPA is the "Do Not Sell My Personal Information" link. If developers are selling personal information, the CCPA requires them to notify California residents of their right to opt out of the sale. For that purpose the Office of the California Attorney General is currently developing a standardized opt out button that developers need to place on their apps' websites. Per the proposed CCPA regulations, the button shall link to a privacy policy or other website that contains the following information:

A description of the consumer's right to opt out
The web form by which the consumer can submit their request to opt out
Instructions for other methods to submit opt out requests
Any proof required when a consumer uses an authorized agent to exercise opt outs
A link to the business's privacy policy (vice versa, the privacy policy must contain a link to the web form)

Many developers, particularly, in the ad space, are currently taking a close look at their business models. After all, which user would not click on a button to stop his or her sale of personal information? Also, having a Do Not Sell Button on one's website is not for everyone from an image perspective. In addition, the administrative burden of processing opt out requests and propagating them downstream to ad partners can be quite high. Some even worry about a "weaponization" of the new privacy rights, which the CCPA tries to prevent, for example, by limiting right to know requests to twice in a twelve-month period. Thus, not all is doom and gloom. In fact, now is a good opportunity for developers to take a step back and think about how they process personal information. It is a good time to use increased privacy protections as a feature and differentiator.

Which privacy disclosures does the CCPA require?

The CCPA is continuing the trend of increasing the importance of privacy policies for disclosing and communicating privacy practices of apps. Privacy policies are the main tool for making legally relevant privacy disclosures. Among others, if the CCPA is applicable to an app, developers have to provide in a privacy policy:

A description of consumers' privacy rights
How those rights can be exercised and how the identity of individuals requesting them is verified
Lists of the categories of personal information collected, sold, and disclosed for a business purpose in the preceding twelve months
The categories of sources from which personal information is collected (e.g., the app itself, data brokers, public repositories, ...)

The privacy policy has to be updated at least once every twelve months. It is also a good idea to keep a public repository of older policy versions because an app's privacy practices will be governed by the policy version at the time of usage.

Whether the CCPA is applicable or not, developers should embrace privacy policies as an artifact of software development. Just as many developers are familiar with different software licensing models, especially in the open source domain, the creation and maintenance of privacy policies should be equally understood as an original task of software developers. Some cases will require additional consultation with a lawyer. However, for garden variety cases policies will be fairly standardized and developers can and should integrate the task in their workflow.

This post is for informational purposes only and does not constitute legal advice. An identical version is published on Medium.

Does your app need a privacy policy?

Sebastian Zimmeck — Wed, 08 Jan 2020 12:57:10 +0000

Generate it directly from your app’s code and earn a $5 Amazon gift card.

We are computer science researchers at Wesleyan University. We developed PrivacyFlash Pro, an automatic generator that produces a privacy policy for your iOS app written in Swift. PrivacyFlash Pro is available on GitHub. We are excited to hear what you think!

If you are an iOS developer, you may also be eligible to participate in our usability study and earn a $5 Amazon gift card. Learn more at our study site.

privacy-tech-lab / privacyflash-pro

Generate a privacy policy for your iOS app

PrivacyFlash Pro

PrivacyFlash Pro analyzes the code of iOS Swift projects to generate a privacy policy. The goals of PrivacyFlash Pro are:

Assisting app developers in understanding the privacy practices used by their apps and third party libraries
Creating a privacy policy covering those practices to notify users and help developers achieving privacy compliance
Establishing standardized privacy policies in the iOS app ecosystem

PrivacyFlash Pro covers provisions of the following laws:

California Consumer Privacy Act (CCPA)
California Online Privacy Protection Act (CalOPPA)
Children's Online Privacy Protection (COPPA)
General Data Protection Regulation (GDPR).

PrivacyFlash Pro was written by David Baraka (@davebaraka), Rafael Goldstein (@rgoldstein01), Sarah Jin (@sj-in), and Sebastian Zimmeck (@sebastianzimmeck ) as an academic project of the privacy-tech-lab at Wesleyan University. Kuba Alicki (@kalicki1) wrote the unit tests.

Installing and Running PrivacyFlash Pro

You can install and run PrivacyFlash Pro from the packaged release or from the source files.

Installing

…

View on GitHub

DEV Community: Sebastian Zimmeck