Frequently asked questions about the CCPA and CPRA

You will learn

Learn about frequently asked questions regarding the CCPA (California Consumer Privacy Act) and CPRA (California Privacy Rights Act).

What is the CCPA?

The CCPA is a law that took effect on January 1, 2020 and governs how businesses handle the personal information of California residents.

The CCPA is a response to a perceived gap in privacy protections in the United States. Businesses covered by the CCPA are required to inform California residents of their privacy practices and residents’ privacy rights, including the right to:

• Know about the personal information a business collects about them and how it is used
• Delete the personal information collected (with some exceptions)
• Opt out of the sale of their personal information
• Non-discrimination for exercising their CCPA rights

What is the CPRA?

The CPRA is a law that amends and expands the requirements of the CCPA, including:

• Adding a "sensitive personal information" category
• Establishing the right to limit use and disclosure of sensitive personal information
• Establishing the right to correct inaccurate personal information
• Expanding the “Do Not Sell” opt-out requirement to the sharing of personal information for cross-context behavioral advertising

The CPRA amendments took effect on January 1, 2023.

Who must comply with the CCPA and CPRA?

Businesses

Most CCPA requirements apply to “businesses,” defined as for-profit entities that collect California consumers’ personal information, either directly or through vendors, and determine the purposes and means of processing that information.

The CCPA, as amended by the CPRA, generally applies to businesses that meet all of the following conditions:

• Handles California residents’ personal information
• Is “doing business” in California (including engaging with individuals located in California through an ecommerce or interactive website or application)
• Satisfies one or more of the following thresholds:
  • Had annual gross revenues greater than $26,625,000 in the preceding calendar year
  • Annually buys, sells, or shares the personal information of 100,000 or more California residents or households
  • Derives 50% or more of its annual revenues from selling or sharing California residents’ personal information. Selling includes disclosing, making available, transferring, or communicating personal information to third parties for monetary or other valuable consideration. Sharing includes these activities for cross-context behavioral advertising, whether or not money or other valuable consideration is exchanged.

The revenue threshold is adjusted every 2 years. Review the current monetary thresholds when assessing whether your business is covered.

Service providers and contractors

In order to be considered a service provider, a person or legal entity must:

• Process personal information on behalf of a business
• Be bound by a written contract that imposes restrictions and obligations on the use of personal information, including prohibiting:
  • Selling or sharing the personal information
  • Retaining, using, or disclosing the personal information for purposes other than the business purposes specified in the contract, except as otherwise permitted by the CCPA
  • Retaining, using, or disclosing the personal information outside the direct business relationship
  • Combining personal information from the business with information from other sources, except for purposes permitted by the CCPA and its regulations

Similar to service providers, the exception to a sale or sharing also applies to contractors under the CPRA. Contractors are persons or entities to which personal information is made available by a business, pursuant to a written contract that imposes similar restrictions and obligations that apply to a service provider. Contractors also must have a certification that the contractor understands the restrictions and will comply with them.

A disclosure to a qualifying service provider or contractor for a business purpose is not considered a sale or sharing when the required contractual conditions are met.

What is classified as personal information?

The CCPA defines personal information very broadly to include information that identifies, describes, or is reasonably capable of being associated with a particular consumer or household. In practice, this broad definition means that information such as contact information, transaction data, Internet Protocol (IP) addresses, mobile device identifiers, clickstream data, and order details may be within the scope of the CCPA’s definition of personal information, and subject to the CCPA’s requirements.

The CPRA added a category of personal information called “sensitive personal information.” Consumers have the right to limit its use and disclosure for purposes beyond those permitted by the CCPA.

Sensitive personal information under the CCPA, as amended, includes:

• Social security number
• Driver’s license or state identification card number
• Passport number
• Account log-in, financial account, debit card, or credit card number combined with credentials that allow access to an account
• Precise geolocation
• Racial or ethnic origin
• Citizenship or immigration status
• Religious or philosophical beliefs
• Union membership
• Biometric information processed to uniquely identify a consumer
• Genetic data
• Neural data generated by measuring activity in the central or peripheral nervous system
• Personal information collected and analyzed concerning a consumer’s health
• Personal information collected and analyzed concerning a consumer’s sex life or sexual orientation
• The contents of a consumer’s mail, email, and text messages unless the business is the intended recipient of the communication

What do I need to do to prepare?

The CCPA and CPRA are complex laws. This article provides the key obligations under the CCPA and CPRA as it may relate to the use of Klaviyo services, but it does not take into account all the requirements that may apply to your business. Please contact your legal counsel for specific advice.

If the CCPA and CPRA apply to your business, you should consider the following rights and disclosures.

Notice

Your business must provide a notice at or before collecting personal information, including through sign-up forms, and make its privacy policy accessible on its website. The notice at collection must include a link to the privacy policy. The policy should include, among other things:

• Categories of personal information it collects, sells, shares, and otherwise discloses for a business purpose
• Categories of sources of the personal information
• Business or commercial purposes for collecting, selling, or sharing personal information
• Description of the following consumers’ rights and the designated methods for submitting requests:
  • The right to delete personal information
  • The right to access categories and specific pieces of personal information
  • The right to opt out of the sale or sharing of personal information
  • The right of non-retaliation

The CPRA expands this list of consumers’ rights to include:

• The right to correct inaccurate information
• The right to limit the use and disclosure of sensitive personal information
• Rights concerning certain uses of automated decisionmaking technology. Businesses that use it to make significant decisions, such as decisions about employment, housing, or financial services, must comply with the ADMT-specific notice, opt-out, and access requirements by January 1, 2027. Consult legal counsel to determine whether these requirements apply to your use.

The CPRA also requires businesses to include the following additional disclosures:

• Whether the individual’s personal information is sold or shared
• The length of time the business intends to retain each category of personal information or the criteria it will use to determine how long it will retain such information
• If the business collects “sensitive personal information”:
  • A separate disclosure identifying the categories of sensitive information collected
  • The use and purpose of this data
  • Whether such information is sold or shared

Opt-out rights

Consumers have the right at any time to opt out of the sale or sharing of their personal information. If your business sells or shares personal information, it must honor these requests and must not resume selling or sharing unless the consumer subsequently authorizes it. You must wait at least 12 months before asking a consumer to opt back in. To support this right, businesses must, among other things:

• Provide a clear and conspicuous “Do Not Sell or Share My Personal Information” link that allows the consumer or their authorized agent to opt out. The regulations also allow an alternative link labeled “Your Privacy Choices” or “Your California Privacy Choices.” Businesses that process opt-out preference signals in the required frictionless manner can use the exception to displaying a separate sale-or-sharing opt-out link.
• Do not require a consumer to create an account to opt out of the sale or sharing of their personal information.

Consumers also have the right to opt out of the sale or sharing of their personal information by a third party that received it from a business. The third party must honor the opt-out unless the consumer subsequently authorizes the sale or sharing.

Other consumer rights

Businesses must verify a California resident’s identity when responding to requests to know, delete, or correct personal information. Once the request is verified, provide the information or take the action required for that request, subject to applicable exceptions. Do not require identity verification for requests to opt out of sale or sharing or to limit the use of sensitive personal information.

Right to know: A consumer may request that the business disclose its collection and treatment of the consumer’s personal information, including the:

• Categories of personal information collected about that consumer (in the preceding 12 months)
• Categories of sources from which the personal information is collected
• Business or commercial purpose for collecting, selling, or sharing personal information
• Categories of third parties to whom the business disclosed personal information
• Categories of information that the business sells or discloses to third parties
• Specific pieces of personal information it has collected about that consumer

The CPRA modifies and expands this right to require:

• Providing information about the categories of personal information “shared” with third parties
• Providing information beyond the preceding 12 months when the consumer requests it, unless doing so is impossible or involves disproportionate effort. This requirement applies only to personal information collected on or after January 1, 2022.

Right of deletion: The business must delete the consumer’s information (subject to certain exceptions) and notify its service providers to delete the consumer’s information. Under the CPRA, the business must notify its service providers and contractors and also notify any third parties to whom the business has sold or shared (for cross-contextual advertising purposes) the consumer’s personal information, unless this “proves impossible or involves disproportionate effort.” Additionally, each service provider must also notify its own downstream service providers to delete the consumer’s information.

Right to correct inaccurate personal information: Once a business receives a verified request, it must use commercially reasonable efforts to correct inaccurate personal information as directed by the consumer. The California Privacy Protection Agency’s regulations set out requirements for handling these requests.

If a business knows a consumer is under 16, the CCPA requires affirmative authorization before selling or sharing their personal information. For consumers under 13, a parent or guardian must authorize it. For consumers aged 13–15, the consumer must authorize it. Klaviyo’s Acceptable Use Policy prohibits collecting or processing information about children under 13 (or under 16 in the EEA), regardless of this CCPA authorization rule.

Fulfilling consumer requests

Businesses that operate exclusively online and have a direct relationship with the consumers whose personal information they collect need only provide an email address for requests to know, delete, or correct personal information.

Other businesses must provide at least 2 designated methods for these requests, including:

• A toll-free telephone number
• A way to submit requests through the business’s website, such as a webform, if the business has a website

For requests to know, delete, or correct personal information, confirm receipt within 10 business days and respond within 45 calendar days of receiving the request. Identity verification does not extend this deadline. If reasonably necessary, you may extend the response deadline by an additional 45 calendar days, but must notify the consumer of the extension and its reasons within the initial 45-day period.

Provide requested information through an existing user account or by mail or electronically in a format the consumer can transfer to another entity. Requests must be free of charge, except that the CCPA permits a reasonable fee for manifestly unfounded or excessive requests. Your business must be able to demonstrate that this exception applies.

For requests to opt out of sale or sharing or to limit the use and disclosure of sensitive personal information, comply as soon as feasible and no later than 15 business days after receiving the request.

Businesses are not required to provide information in response to a request to know more than 2 times per consumer in a 12-month period. This limit does not apply to requests to delete or correct personal information.

What is Klaviyo's role under the CCPA and CPRA as it relates to the Klaviyo service?

When Klaviyo processes personal information on behalf of your business under the Data Processing Agreement, it acts as a service provider. Your business is responsible for responding to and fulfilling your customers’ consumer-rights requests.

Klaviyo’s obligations to customers as a service provider are set forth in our Data Processing Agreement.

What is Klaviyo doing to enable customers to comply?

Klaviyo provides tools to help you respond to requests to access, delete, or correct personal information stored in your account. Use these tools as part of your response, alongside information and actions required in your other systems. Your user role must allow profile exports and file downloads for access requests, and profile editing for corrections or deletions. Specifically:

• You can export a profile’s data for an access request. From the profile, select Profile actions > Export profile, then Start export. Follow View all downloads and select Download when the export is ready to save the .zip file.
• You can delete a profile and record the privacy request. Deletion is permanent. If you also need an export, download it before deleting the profile. Select Profile actions > Delete Profile, check Delete profile in compliance with data privacy request, and confirm with Delete profile. This records the request and starts deletion; the profile remains accessible until deletion is complete.
• You can correct editable contact information on profiles in Klaviyo. Select Profile actions > Edit contact information, enter the corrected information, and select Update. Review the profile to confirm the change.
• You must follow Klaviyo’s Acceptable Use Policy, which prohibits collecting, storing, processing, sending, or transmitting certain data, including health information and non-public government identification numbers.

Additional resources