This page may contain affiliate links. If you make a purchase through any of these links, I may make a small commission. Click here for my full disclosure statement.
If you haven’t yet heard about the CCPA, then this is definitely something any online entrepreneur, business, or even brick-and-mortar business utilizing online advertising should be made aware of. As you may know, the content on my website is completely free to access and remains free thanks to my ability to monetize my content through both my ad network, who places targeted ads on my blog, and affiliate marketing, which also allows me to make a small commission off purchases you may buy through specialized links on my website. Aside from publishing sponsored posts, these are 2 of the 3 most important ways that bloggers and influencers make money online.
For the past 2 months I’ve been working together with Make Privacy Work Coalition to attend Senate hearings and lobby for bills to help fix the California Consumer Privacy Act, a new set of laws that will negatively impact the way that we are able to monetize our content online if left unchanged. And yes, even if your business does not reside in California, this will affect you too.
What is the California Consumer Privacy Act?
The CCPA was approved on June 28th, 2018 and consists of 33 pages of legislative text regarding how businesses are legally able to collect and use consumer information. The CCPA was created in attempts to protect consumer privacy and stop large corporations such as Facebook or Google from selling online users’ information to third parties; however, it was rushed through California state legislature in a neck-breaking 7 days, leaving many parts of the act open-ended and vague.
The purpose of CCPA will allow online users the right to know all the data collected by a business, the right to say no to the sale of their information, as well as the right to sue companies who misuse your information or are subject to a data breach. It also allows users to demand businesses to delete any data you have collected and shared.
While this sounds like a great step forward to protect online consumer privacy, the CCPA is actually a broad sweeping privacy law with many vague descriptions and unclear definitions that will hurt online businesses in a number of ways. While myself and the Make Privacy Work Coalition are fully in support of finding ways to better protect consumer privacy, we also want to make fixes to the CCPA that will be fair for businesses who will be affected.
Who Does The CCPA Affect? If You’re Reading This, Probably You
This new privacy law applies to you if your business or blog:
- Has a minimum of 50,000 online visitors per year (or about 137 online visits per day) to your ad-supported blog – and that number could be a lot less because if someone visits your website from two different devices – like their phone and their computer – they would be counted twice!
- Conducts a minimum of 50,000 credit card transactions a year which is basically only about 12 transactions per hour in a 12-hour day.
- Has some combination of both descriptions above (or other types of data) that hits the 50,000 threshold – i.e. 40,000 online visitors and 10,000 credit card transactions.
Basically, if you are a blogger with average traffic, expect to comply. And compliance means that you may have to incorporate a way for your readers to opt-out of having their cookies collected and sever the cookie distribution to your ad network, if your ad network has not appropriately figured out a way to control this information. Doing this on your own without sufficient technical knowledge will leave you vulnerable to legal liability, and paying for a professional to do this for you might be costly.
Who else could possibly be affected? Well, if you’re a brick-and-mortar business relying on Google, Facebook ads or any other type of third-party company to advertise your business, you may be affected as well.
You may be affected if you:
- Build your email subscriber list using a third-party email marketing provider such as ConvertKit, MailerLite, MailChimp, AWeber, etc.
- Host a course on platforms like Teachable or Thinkific
- Use affiliate networks to place affiliate links on your website (Rakuten Linkshare, CJ, RewardStyle, Shopstyle, etc.)
- Use an ad network to monetize your content (Google AdSense, Mediavine, AdThrive, etc.)
- Pay for online ads to advertise your business to potential customers (Google AdSense, Facebook ads, Instagram ads, or any other form or paid advertising)
- Run an online store where you collect and save customer information for email marketing, provide coupons and discounts, or have a loyalty program
- Have a website that allows potential clients to set up a consultation with you
- Are a Realtor and get client leads from companies like Redfin, Trulia, Zillow, Realtor.com or more
Basically, if you run a business where information is handled by you or distributed to a third-party service, you may be at risk.
What If I Don’t Sell User Information?
Many people who are aware of the CCPA assume that this law does not apply to them because they do not sell information. However, if you read the first paragraph of the Act, it says this:
The act defines the terms “sell,” “selling,” “sale,” or “sold” to mean selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to another business or a third party for monetary or other valuable consideration.
This means that whether or not you actually sell the information in exchange for compensation, it still applies to you. In this law, “selling” is synonymous with “transferring” or “making information available” to a third party. In other words, bloggers sell ad space and not user information. But, along with selling that ad space some data is transferred. If you use any third-party software to collect a user’s information (such as collecting emails to build your subscriber list or utilizing an ad network), this law applies to you.
What Happens If the CCPA Is Not Fixed?
Time is of the essence. Although the law has been passed, the law will not go into effect until January 1, 2020. If it is not fixed by then, the law would:
- Cover far more small businesses, like ad-supported blogs, than intended;
- Essentially force businesses to compile all the information about who views their websites in one place in order to respond to consumer requests (even if you just track IP addresses for web analytics and don’t link them back to specific people);
- Put targeted advertising at risk – a serious negative implication for ad-supported blogs;
- Put loyalty and rewards programs at risk – the law raises doubt about the legality of loyalty and rewards programs from retailers, grocers, hotels, and airlines; and
- Require businesses to create and staff a toll-free number to respond to privacy requests from this new law.
This will already be an incredibly expensive and complicated law for businesses to comply with and the stakes are very high. Violations of this law will be prosecuted with a fine of $2,500 per incident – or as much as $7,500 per incident (and one error in compliance could lead to numerous “incidents” depending how many consumers are impacted by the error). That’s why it’s crucial we fix as many of the flaws with the current language of the CCPA as possible.
What If I Don’t Live in California?
Similar to the GDPR, even if your business does not reside in California, you will still have to comply with California law if you have online visitors from California. If you’re a studious blogger, you may have remembered how stressful this time was due to the lack of available information and direction of how to comply before it went into effect. This will be a similar experience.
Is There A Way Around Having to Comply?
Technically, if you do not want to run the risk of being in non-compliance, you can potentially pay a web developer to figure out how to block visitors with IP addresses in California. But really, who in their right mind would want to block visitors from their website? Even if you decided on this impractical course of direction, there could be many potential headaches to face in order to make this work seamlessly on your website. And if you’ve ever outsourced web developing, you’ll probably know that this kind of project would be expensive to have someone do for you.
How Can We Fix This?
If you are just as concerned about the CCPA as it stands, please help me, the Make Privacy Work Coalition and our many small business to support the following bills to change the CCPA:
- SB-753: Unfortunately, this bill was pulled earlier in April, but we’re hoping to raise awareness for the need to address targeted advertising in a future bill. SB-753 was written by Senator Henry Stern in attempts to make exceptions for people like us to continue using targeted advertising. If this is not fixed, we’ll be banking on the hopes that our ad networks can create an update for their ad plugins to automatically detect California users and block our ads on their browser. If our ad networks do not make this service available to us, we may have to hire a web developer who can create something for us to do this. Worst case scenario: we would have to resort to placing affiliate ads on our website instead of customized ads, leading to a major loss of potential ad income.
- AB-873: Helps clarify the definition of “personable information” to a more reasonable standard. The CCPA defines personal information far more broadly, and AB-873’s “reasonable” definition would make an exception for bloggers and businesses who cannot shoulder the unreasonable burden that the CCPA carries. Without this, we would have to collect more data, and data breaches as a result of insecure data collection could actually harm privacy.
- AB-846: Prevents California residents from participating in loyalty and rewards programs and from accessing coupons offered by businesses. Say goodbye to redeeming frequent flyer miles or the ability to email coupons to your California customers (course creators and ebook authors, I’m talking to you).
For more information on these bills, you can download this CCPA Fact Sheet for Bloggers and Online Businesses.
Because the CCPA goes into effect on January 1st, 2020, I encourage everyone who will be affected by this to take the time and share this post, call or email your local senators about your concerns, and help us get these bills approved. Consumer privacy does matter, but we can better protect consumer privacy without negatively affecting businesses everywhere.
If the CCPA will affect you, then here’s what you can do to help:
- Write a letter to state legislators here.
- Author an opinion editorial to your newspaper: email adriana [at] elevatepublicaffairs [dot] com
- Visit MakePrivacy.Work for more information and see how else you can get your voice heard
- Attend a meeting with Senators and Assembly members. There will be many meetings happening in major cities across California. Please reach out to adriana [at] elevatepublicaffairs [dot] com for more information on how you can get involved.
Live Q&A Session With Kevin McKinley, CA Director of Government Affairs (Internet Association)
EDIT 6/26/19: The video replay of the Q&A livestream is available above and on Facebook! The conversation starts around 3:20 on the video timeline.
6/17/19: On Wednesday, June 26th at 12:30PM PST, I will be hosting a Q&A session with Kevin McKinley to answer any questions that you business owners might have regarding the California Consumer Privacy Act. McKinley is the Director of California Government Affairs at the Internet Association and worked as a litigation attorney representing clients in areas of privacy, cyber crimes and more.
The AMA will go live on the official Make Privacy Work Facebook Page, so mark this on your calendar! If you can’t make it, the video will be available to replay, but I would highly suggest trying to make it to the live session so you can join the conversation and get your questions answered by Kevin.
What do you think about the California Consumer Privacy Act? How do you think it will affect you? Let’s chat in the comments below. Remember to download the CCPA Fact Sheet for Bloggers and Online Businesses!
Don’t forget to follow me on Instagram and subscribe to my newsletter for more blogging and online business tips. Make Privacy Work can also be followed along on their website, Instagram, Twitter and Facebook.
And if you’ve read up to here, here are some photos of our recent lobbying day with Make Privacy Work! We sat down with several directors, senators, and analysts in the State Capitol help inspire some much-needed changes to the CCPA in hopes of helping small businesses.
More on How to Make Money Blogging:
- How to Start a Fashion Blog: The Ultimate Guide
- Blogger Tax Deductions and Tips That Can Prevent a Huge Tax Bill (And An Audit)
- The Blogger Crash Course: 9 Must-Have Tools to Make Money Blogging
- What is the CCPA and How Will It Affect Your Online Income?
- 2019 Income Report: Tough Lessons I Learned During My 3rd Year of Being Self-Employed