Categories of third parties means types of entities that do not - PDF document

1 TITLE 11. LAW “Categories of third
TITLE 11. LAW “Categories of third parties” means types of entities that do not collect personal information directly from consumers, including but not limited to advertisiders, government entities, operating systems and platforms, social networks, and consumer data resellers. “CCPA” means the California Consumer Privacy Act of 2018, Civil Code sections 1798.100 “Financial incentive” means a program, benefit, or other offering, including payments to consumers as compensation, for te of personal information. “Household” means a person or group of people occupying a “Notice at collection” ms to a consumer at or before the time a business collects personal information from the consumer“Notice of right to opt-out” means the notice given by a business informing consumers of personal informatio“Notice of financial incentive” means the notice given by “Price or service difference” means (1) any difference in goods or services to any consumerpayments, or other benefits or pengoods or services offered to any consumer, including denial of goods or services to the consumer. (m)“Privacy policy” means the policy referred to in Civil Codmeans the statement that a business shall make available to consumers describing the sale of personal information and of the rights of consumers reginformation. “Request to know” means a consumer request that a business disclose personal information consumer pursuant to Civil Code sections 1798.115. It includes a

2 request forSpecific pieces of personal i
request forSpecific pieces of personal information that a business has about the consumer; Categories of personal information it has collected about the consumer; Categories of sources from which the personal information is collected; Categories of personal informabusiness purpose about the consumer; o whom the personal information ￿￿(a) Purpose and General Principles (1) The purpose of the notice at cmers at or before the time of collection of a consumer¶s personal information of the categories of personal information to be collected frothem and the purposes for which the categories of personal information will be used. (2) The notice at collection so the consumer in a way that is easy to read and understandable to an average consumer. The notice shall: a. Use plain, straightforwarb. Use a format that draws the consumer¶s attention to the notice and makes the notice readable, including on smac. Be available in the languages in which the business in its contracts, disclaimers, sale announcements, and other information to consumers. The business or commercial puinformation. “Request to delete” means a ss delete personal information about the consumer that the businsumer, pursuant to Civil “Request to opt-out” means a consumer request that a business not sell the consumer¶s personal information to third par“Request to opt-in” means tat the business may sell personal information about the consumer required by Civil Code section 1798.120(c) by a parent or

3 guardian of a consumer less thamer who h
guardian of a consumer less thamer who had previously opted out of the sale of their personal information. “Third-party identity verification service” means a securiindependent third party who verifies the identity of the consumer making a request to the business. Third-party verification services are subject to the requirements set forth in “Typical consumer” means a natural person residing in the United States.“URL” stands for Uniform Res“Verify” means to determine that the consumer making a reqdelete is the consumer about whomformation. Article 2. Notices to Consumers§ 999.305. Notice at Collection of Personal Information Be accessible to consumers with disabilities. At a minimum, provide information on how a consumer with a disability may access the notice in an alternative format. Be visible or accessible where consumers will see it beforeinformation is collected. For example, when a business collects consumers¶ personal information online, it may conspicuously post a link to the notice on the business¶s website homepage or the mobile application¶s download page, or on all webpages where personal information is collected. When a business collects consumers¶ personal information offline, it may, for example, ion printed forms that collect personal information, provide the consumer with a t prominent signage directing consumers to the A business shall not use a consumer¶s personal informationntends to use a consumer¶s personal information for a purpos

4 e that was not previously disclosed to t
e that was not previously disclosed to the consumer the consumer of this new om the consumer to use it forA business shall not collect categories of personal informcategories of personal informacollection.If a business does not givee consumer at or before the collection of their personal information, the business shall not collect personal information fromthe consumer. A business shall include thellection: A list of the categories of personal information about consumers to be collected. Eachcategory of personal information shall be written in a manner ta meaningful understanding of the information being collected. For each category of personal information, the business orIf the business sells persInformation” or “Do Not Sell A link to the business¶s privacy policy, or in the case of offline notices, the web If a business collects personal information froma consumer online, the notice at collection may be given to the consumer by prmation required in subsection (b) ￿￿(a) Purpose and General Principles (1) The purpose of the notice ofersonal information is to inform consumers of their right to direct a business that sells (or may in the future sell) their personal information to stop selling their personal information, and to refrain from doing so in the future. (2) The notice of right to opt-nted to the consumer in a way ndable to an average consumer.a. Use plain, straightforwarb. Use a format that draws the consumer¶s attention to the notice and makes the notice re

5 adable, including on smac. Be available
adable, including on smac. Be available in the languages in which the business in its contracts, disclaimers, sale announcements, and other information to consumers. d. Be accessible to consumers with disabilities. At a minimum, provide information on how a consumer with a disability may access the notice in an alternative format. A business that does not collect information directly from consumers does not need to the consumer, but before it can sell a consumer¶s personal information, it shall do eContact the consumer directusiness sells personal information about the consumer and provide the consumer with a Contact the source of the personal information to: Confirmthat the source provided a notice at collection to the consumer in accordance with subsections (a) and (b); andnotice at collection and including an example of the notice. Aretained by the business for at least two years and made available to the consumer § 999.306. Notice of Right to Opt-Out of Sale of Personal Information A business that sells the personal information of a consumer shall provide a notice of right to opt-out to the consumer as follows: A business shall post thethe consumer is directed afterPersonal Information” nk on the website homepage or the dopage of a mobile application. Theormation specified in policy that contains the same information. A business that substantially interacts with consumers offto the consumer by an offline method that facilitates consumer awareness of their right to opt

6 -out. Such methods include, but are not
-out. Such methods include, but are not limited to, prinforms that collect personal information, providing the consumerof the notice, and posting signage directing consumers to a webA business that does not opera, document, and comply with another method by which it informs consumers of their right to direct a business that sells their personal informati information. That method shall comply with the requiremeA business shall include theA description of the consumer¶s right to opt-out of the sainformation by the business;The webform by which the consumer can submit their request to opt-out online, as offline method by which the consumer can submit their request tInstructions for any other method by which the consumer may submit their request to Any proof required when a consumer uses an authorized agenlocation, or URL where consumers can find information about autA link or the URL to thehe webpage where consumers cA business is exempt fromIt does not, and will not, sell personal information collected during the time period It states in its privacy policy that that it does not and will not sell personal information. A consumer whose personal information is collectenotice is not posted shall be deemed to have validly submittedOpt-Out Button or Logo The following opt-out button or logo may be used in additi >BUTTON OR LOGO TOBE ADDED IN A MODIFIED VERSION OF THE REGULATIONS AND MADE AVAILABLE FOR PUBLIC COMMENT.] (b) A business shall include thenancial incentive:(1) A succinct

7 summary of the f(2) A description of the
summary of the f(2) A description of the material terms of the fies of personal information that are implicated by the financial incentive or pri(3) How the consumer can opt-in to the financial incentive or (4) Notification of the consumtime and how the consumer may exercise that right; and § 999.307. Notice of Financial Incentive (a) Purpose and General Principles (1) The purpose of the notice oflain to the consumer each umer¶s personal information so that the consumer may make an informed decision on whether to participate. (2) The notice of financial iesented to the consumer in a mer. The notice shall:a. Use plain, straightforwarb. Use a format that draws the consumer¶s attention to the notice and makes the notice readable, including on smac. Be available in the languages in which the business in its contracts, disclaimers, sale announcements, and other information to consumers. d. Be accessible to consumers with disabilities. At a minimum, provide information on how a consumer with a disability may access the notice in an alternative format. e. Be available online or otheers will see it before (3) If the business offers the financial incentive or price of service difference online, the notice may be given by providing that contains the informati information specified in sectpolicy that contains the same information. § 999.308. Privacy Policy (a) Purpose and General Principles (1) The purpose of the privacer with a comprehensive disclosure, and sale of personal info

8 rmation and of the rights of consumers r
rmation and of the rights of consumers regarding their personal information. Then specific pieces of personal information about individual consumers and need not beeach consumer. (2) The privacy policy shall beconsumer. The notice shall:a. Use plain, straightforwarb. Use a format that makes the policy readable, including on smaller screens, if applicable.c. Be available in the languages in which the business in its contracts, disclaimers, sale announcements, and other information to consumers. d. Be accessible to consumers with disabilities. At a minimum, provide information on how a consumer with a disability may access the policy in an alternative format. e. Be available in an additional format that allows a consumerseparate document. (3) The privacy policy shall bsite homepage or on the downloaa mobile application. If the businconsumers¶ privacy rights on itsthat description. A business thhall make the privacy ble to consumers. (b) The privacy policy shall include the following information An explanation of why the financial incentive or price or permitted under the CCPA, including: A good-faith estimate of the value of the consumer¶s data that forms the basis for or price or service difference; and A description of the method theconsumer¶s data. Right to Know About Personal Information Collected, DiscloExplain that a consumer has the right to request that the business disclose what personal information it collects, uses, discloses, and sells. Provide instructions f

9 or submitting a verifiable consumer requ
or submitting a verifiable consumer request to know and form or portal for making thiness will use to verify the consumer request, including any information the consumer must provide. Collection of Personal Information mers¶ personal information the collected about consumers in tce shall be written in a manner that provides consumers a meaningful understhe information being collected. For each category of personal information collected, provide the categories rmation was collected, the busincommercial purpose(s) for which the information was collected, information. The notice shall be written in a manner that provconsumers a meaningful understandDisclosure or Sale of Personal Information State whether or not the business has disclosed or sold anyinformation to third parties for a business or commercial purpopreceding 12 months. onal information, if any, that ithird parties for a business or commercial purpose in the preceation of minors Right to Request Deletion of Personal Information Explain that the consumer hainformation collected or maintained by the business. Provide instructions for submitting a verifiable consumer r form or portal for making thiness will use to verify the consumer request, including any information the consumer must provide. Right to Opt-Out of the S and Requests to Delete Explain that the consumerinformation by a business.Right to Non-Discrimination for the Exercise of a ConsumerExplain that the consumer has a right not to receive discriminatory treat

10 ment by Authorized Agent Explain how a
ment by Authorized Agent Explain how a consumer can desimake a request under the CCPA on the consumer¶s behalf. Contact for More Information: Provide consumers with a contact for questions or privacy policies and practices using a method reflecting the manner in which the business primarily interacts with the consumer. Date the privacy policy was last updated. If subject to the requirements set forth section 999.317(g), the information compiled in Article 3. Business Practices A business shall provide two or more designated methods for submitting requests to know, including, at a minimum, a tolwebsite, an interactive webformaccessible through the business¶s website or mobile application. Other acceptable methods for submitting these reqlimited to, a designated email address, a formsubmitted in persubmitted through the mail. A business shall provide two or more designated methods for submitting requests to delete. Acceptable methods for submitting these requests include, but aphone number, a link or formilable online through a business¶s website, a designated email address, a formsubmitted in person, and a formsubmitted through the mail. A business shall consider the methods by which it interacts with consumers when determining which methods to provide for submitting requests todelete. At least one method offered shall reflect the manner in which the business primarily interacts with the consumer, eveoffer three methods for submitting requests to know. Illustrative e

11 xamples follow: now and Requests to
xamples follow: now and Requests to Delete etailer, at least one method byconsumer may submit requests setail website. ite but primarilth customers in person at a retail location, the business shall offer three methods to submit requests to know²a toll-free telephone numbebusiness¶s website, and a formthat can be submitted in personat the retail location.A business shall use a two-step process for online requests to delete where the consumer must first, clearly submit the rwant their personal information deleted. If a business does not interact directly with consumers inleast one method by which a consumer may submit requests to knoIf a consumer submits a request in a manner that is not one of the designated methods of submission, or is deficient in some manner unrelated to the vershall either: Treat the request as if it had been submitted in accordancdesignated manner, or Provide the consumer with sbmit the request or remedy equest, if applicable. Upon receiving a request to know or a request to delete, aovide information about how the business will process the request. The information providewhen the consumer should expectBusinesses shall respondday period will begin on the day that the business receives the request, regardless of time . If necessary, businesses may take up to an additional 45 days to respond to the consumer¶s request, for a maximum total of 90nsumer with notice and an the business will take more than 45 days to respond to the (c) Responding to

12 Requests to Know (1) For requeststhat s
Requests to Know (1) For requeststhat seek the disclosure of specific pieces of information about the consumer, if a business cannot verin making the request ormation to the requestor and shall inform the consumer business shall also evaluate the consumer¶s request as if it iscategories of personal information about the consumer pursuant (2) For requests that seek thesonal information about the consumer, if a business cannot verin making the request s may deny the request to r information requested and shall inform the requestor the consumer to its general business practices regarding the collection, maintormation set forth in its (3) A business shall not provide a consumer with specific pieces of personal information if that personal information, the consumer¶s account with the busithe business¶s systems or networks. (4) A business shall not at any time disclose a consumer¶s Socdriver¶s license number or other government-issued identification number, financial or medical identification number, an account (5) If a business denies a consumer¶s verified request to knowinformation, in whole or in part, bexception to the CCPA, the business shall inform the requestor for the denial. If the requinformation sought by the consumer. (6) A business shall use reasonable security measures when transmitting personal information to the consumer. (7) If a business maintains a password-protected account with the consumer, it may comply with a request to know by using a secure self-ser

13 vice portal for consumers to access, vie
vice portal for consumers to access, view, and receive a portable copy of their personal information if the portal ormation that the consumer is eCCPA and these regulations, uses(8) Unless otherwise specified, the 12-month period covered by a consumer¶s verifiable ￿￿(d) Responding to Requests to Delete (1) For requests to delete, if n Article 4, the business may den(2) A business shall comply with a consumer¶s request to delete their personal information a. Permanently and completely erasing the personal informationsystems with the exception of archived or back-up systems; b. De-identifying the personal information; or c. Aggregating the personal information. date the business receives the request, regardless of the time In responding to a consumer¶sinformation, categories of sources, and/or categories of third e to the consumer as required by the CCPA. It shallnot refer the consumer to the buspolicy unless its response would be the same for all consumers discloses all the information thapersonal information, the business shall provide for each identified category of personal information it has collected about the consumer: om which the personal informatiThe business or commercial puinformation; category of personal information for a business purpose; and The business or commercial pupersonal information. mation, categories of sources of personal information, and categdisclosed personal information, in a manner that provides consumers a meaningful understanding

14 of the categories listed. If a busines
of the categories listed. If a business stores any personal information on archived or backup systems, it may delay compliance with the consumer¶s request to delete, with rethe archived or backup system, until the archived or backup sysIn its response to a consuminess shall specify the manner in which it has deleted the personal information. In responding to a request tclose that it will maintain a record of the request pursuant to Civil Code section 1798.105(dIn cases where a business denies a consumer¶s request to dInform the consumer that it will not comply with the consumdescribe the basis for the denial, including any statutory and regulatory exception Delete the consumer¶s personal information that is not subjNot use the consumer¶s personal information retained for any other purpose than In responding to a request to delete, a business may present the consumer with the of their personal information delete all personal information is also offered, and more prominently presented than the other choices. The business firmation process where the consumer confirms their sTo the extent that a person or entity provides services to a person or organization that is not a business, and would otherwise meet the requirements of a “serCode section 1798.140(v), that person or entity shall be deemedpurposes of the CCPA and these regulations. To the extent that a business directs a person or entity to collect personal information herwisemeet all other requirements of a “service

15 prentity shall be deemed a serviCPA and
prentity shall be deemed a serviCPA and these regulations. A service provider shall not use personal information recea consumer¶s rovider may, however, combine personal information received from one or more entitiesprovider, on behalf of such businesses, to the extent necessary to detect data security incidents, or protect against fraudulent or illegal activity. If a service provider receives a request to know or a request to delete from a consumer regarding personal information thats, maintains, or sells on basis for the denial. The servihe consumer that it should submit the request directly to tthe information and, when feasible, provide the consumer with contact information for that A service provider that is a business shall comply with the CCPA and these regulations with regard to any personal information that it collects, maintains, or sells outside of its role as a Requests to Opt-OutA business shall provide two or more designated methods for submitting requests to opt-out, including, at a minimum, an interactive webform accessible via titled “Do Not Sell My Personal Information,” or “Do Not Sell Mwebsite or mobile application. Other acceptable methods for submitting these requests include, but are not limited to, a toll-free phone number, a designated email address, a formsubmitted in person, a formsubmitted through the mail, and useacy setting or other mechanism,the consumer¶s choice to opt-outinformation. A business shall consider the methods by which it inte

16 racts with consumers when determining wh
racts with consumers when determining which methods consumers may use to submit requests to opt-out, the manner in l information to third parties,of use by the average consumer. At least one method offered shall reflect the manner in eracts with the consumer. If a business collects personal information fromconsumers online, the business shall treat mechanism, that communicate or signal the consumer¶s choice to personal information as a valid request submitted pursuant to C, if known, for the consumer. In responding to a request to opt-out, a business may present the consumer with the choice egories of personal information as long as a global option to onal information is more promine Upon receiving a request to opt-out, a business shall act A business shall notify all third parties to whom it has sold the personal information of the consumer within 90 days prior to the business¶s receipt of the consumer¶s request that the consumer has exercised their right to opt-out and instruct theminformation. The business shall notify the consumer when this has been completed.A consumer may use an authorized agent to submit a request to opt-out on the consumer¶s behalf if the consumer provides rmission to do so. Abusiness may deny a request fromnot submit proof that they umer to act on the consumer¶s behalf. User-enabledr other mechanism, that communicate or signal the consumer¶s choice to opt-out of the sale of their personal information shall be considered a request directly fro

17 msumer, not through an A request to opt-
msumer, not through an A request to opt-out need not be a verifiable consumer reqgood-faith, reasonable, and documentebusiness may deny the request. The business shall inform the requesting party that it will not comply with the request and sormationRequests to opt-in to thewhereby the consumer shall firsA business may inform a consumer who has opted-out when a transaction requires the sale of their personal information as a condition of completing the consumer can opt-in. All individuals responsible for handling consumer inquiriepractices or the business¶s compliance with the CCPA shall be informed of all the requirements in the CCPA and these regulations and how to direct consumers to exercise their rights under the CCPA and these regulations. A business shall maintain records of consumer requests made pursuant to the CCPA and (c) The records may be maintained in a ticket or log format prh the request was made, the nied in whole or in part. (d) A business¶s maintenance of the information required by this section, where that information is not used for any other purpose(e) Information maintained for(f) Aside fromthis record-kinformation solely for the purpose of fulfilling a consumer request made under the CCPA. (g) A business that alone or in combination, annually buys, reres for commercial purposes, the personal information of 4,000,000 or more consumers, shall: (1) Compile the following metriar: a. The number of requests to knowcomplied with in b. The number of request

18 s to delete that the business received,
s to delete that the business received, complied with in c. The number of requests to optd, complied with in d. The median number of days within which the business substantively responded to (2) Disclose the information compiled in subsection (g)(1) within their privposted on their website and accessible from a link included in (3) Establish, document, and comply with a training policy to responsible for handling consumermpliance with the CCPA are informed of all the requirements in these regulations and the CCPA. Requests to Access or Delete Household Information (a) Where a consumer does not have a password-protected accounmay respond to a request to know orinformation by providing aggregate household information, subject to verification requirements set fo If all consumers of the houso specific pieces of information for the household or the deletion of household personal informationindividually verify all the members of the household subject to verification requirements set ss shall comply with the reqArticle 4. Verification of RequestsGeneral Rules Regarding VerificationA business shall establish, document, and comply with a reasonable method for verifying that the person making a request is the consumer about whomllected information. In determining the method by which the businessy the consumer¶s identity, the business shall: Whenever feasible, match tded by the consumer to the personal information of the consumer already maintained by the ervice that complies with thAvoi

19 d collecting the types of personal infor
d collecting the types of personal information identif consumer. Consider the following factors: The type, sensitivity, and value of the personal informatiomaintained about the consumer. Sensitive or valuable personal information shall rsonal information ed presumptively sensitive;The risk of harm to the consumer posed by any unauthorized access ordeletion. A greater risk of harm to the consumer by unauthorized access or deletionThe likelihood that fraudulent or malicious actors would seinformation. The higher the likelihood, the more stringent theshall be; Whether the personal information to be provided by the consumer to verify their The manner in which the business interacts with the consume A business shall generally athe consumer for purposes of verification. If, howconsumer fromthe information already maintained by the business, the business may request additional information from the consumer, which shall o consumer seeking to exercise their rights under the CCPA, and for security or fraud-prevention purposes. The business shall delete any new personal information collected for the purposes of verification as soon the consumer¶s request, except A business shall implement reasonable security measures toverification activity and prevent the unauthorized access to or deletion of a consumer¶s personal information. If a business maintains consumer information that is de-idobligated to provide or delete this information in response to a consumer request or to re-rify a

20 consumer request. If a business maintai
consumer request. If a business maintains a password-protected account with the consumer, the business may verify the consumer¶s identity tthe consumer¶s account, provided requirements in section uire a consumer to re-authenticate themselves before e consumer¶s data. If a business suspects fraudulent or malicious activity on or fromomply with a consumer¶s request to know or request to on procedures determine that the consumer request is authentic and the consumer making the requeinformation. The business may use the procedures set forth in verify the identity of the consumer. Verification for Non-AccountholdersIf a consumer does not have or cannot access a password-prbusiness, the business shall comp A business¶s compliance with a request to know categories of personal information requires ntity of the consumer making th reasonable degree of certainty. A reasonable degree of certainty may include matching at least two data points provided by the consumer with data points maintained by business has determined to be reying the consumer. A business¶s compliance with a request to know specific pieces of personal information requires that the business verify the identity of the consumer making the request to a ty, which is a higher bar for verification. A reasonablyhigh degree of certainty may include matching at least three pieces of personal information provided by the consumer with personal information maintained bdetermined to be reliable for the purpose of verifying

21 the consumer together with a signed dec
the consumer together with a signed declaration under penalty of perjury that the requestor is the consumer whose personal information is the subject of the request. Businesses shall maA business¶s compliance with a request to delete may requiidentity of the consumer to a readepending on the sensitivity of the personal information and the risk of harm to the consumer posed by unauthorized deletion. For example, the deletion of family photographs and documents may require a reasbrowsing history may require a rfaith when determining the appropriate standard to apply when verifying the consumer in accordance with the regulatiIllustrative scenarios follow: If a business maintains personal information in a manner associated with a named actual person, the business may verify the consumer by requiring the consumer to provide evidence that matches the personal information maintainFor example, if the business maintains the consumer¶s name and credit card number, the business may require the consumer to provide identifying a recent purchase made with the credit card to veriIf a business maintains personal information in a manner that is not associated with a named actual person, the business may verify the consumer by requiring the consumer to demonstrate that they are the sole consumer associated with the non-nameidentifying information. This mauct a fact-based If there is no reasonable method by which a business can verify the identity of the consumer to the degree of certainty re

22 quired by this sersonal information the
quired by this sersonal information the business holds, in the business¶s privacy policy. The business shall alreasonable method by which it can her such a method can be establiAuthorized AgentWhen a consumer uses an authorized agent to submit a requedelete, the business may require that the consumer: Provide the authorized agent written permission to do so; Verify their own identitSubsection (a) does not apply when a consumer has providedA business may deny a request fromsubmit proof that Article 5. Special Rules Regarding MinorsProcess for Opting-In toSale of Personal InformationA business that has actualinformation of children under cument, and comply with a reasonable method for determining that the person affirmatively authorizing the sale of the personal information about the child is the parent or guardian of that child. Thisaffirmative authorization is in addition to any verifiable pareunder the Children¶s Online Privacy Protection Act, 15 U.S.C. sMethods that are reasonabl business by postal mail, facsimile,n, in connection with a monetar online payment system that o the primary account holder; all a toll-free telephone numbonnect to trained personnel via video-conference; ommunicate in person with traiVerifying a parent or guardian¶s identity by checking a forissued identification against databases of such information, whleted by the business from its records promptly after When a business receives an affirmative authorization pursrm the parent or guardian of than

23 d 1798.185(a)(6), Civil Code. A business
d 1798.185(a)(6), Civil Code. A business that has actualaintains the personal information of minors at least 13 and less thlish, document, and comply allowing such minors to opt-in to the sale of their personal information, pursuant to section 999.316. When a business receives a request to opt-in to the sale of personal information from a minor at least 13 and less thahall inform the minor of the A business subject to section 999.330 and 999.331 shall inA business that exclusively targets offers of goods or services directly to consumers under 16 years of age and does not sell the personal information of such minors without their affirmative authorization, or the affirmative authorization of minors under 13 years of age, is Article 6. Non-DiscriminationDiscriminatory Practices financial incentive or adiscriminatory, and therefore ts a consumer differently because the consumer exercised a right conferred by the CCPA orNotwithstanding subsection ( may offer a price or service umer¶s data as that termIllustrative examples follow: : A music streaming business offers a free service and a premithat costs $5 per month. If only the consumers who pay for the music streaming formation, then the practice is discriminatory, unless the $5 per month payment is reasonably related to the value of the consume: A retail store offers disctheir mailing list. If the consumer on the mailing list can codiscounted prices even after they have made a request to know, criminatory. A business¶s denia

24 l of a consumer¶s request to know, requ
l of a consumer¶s request to know, request to delete, or request to opt-out for reasons permitted by the CCPA or these regulations shall nodiscriminatory. A business shall notify consumers of any financial incentiA business¶s charging of a rshall not be considered a financial incentive subject to these Calculating the Value of Consumer DataThe value provided to the consumer by the consumer¶s data, as that termis used in Civil provided to the business by the consumer¶s data and lue of the consumer¶s data.” To estimate the value of the consumer¶s data, a business o reasonable and good faith method forhe consumer¶s data. The more of the following: The marginal value to the business of the sale, collection, or deletion of a consumer¶s The average value to the business of the sale, collection, or deletion of a consumer¶s Revenue or profit generated by the business from separate tiers, categories, or classes of consumers or typical consumers Revenue generated by the business from sale, collection, or retention of consumers¶ personal information; Expenses related to the consumers¶ personal information; Expenses related to the offer, provision, or imposition ofProfit generated by the busin retention of consumers¶ personal information; and Any other practical and reliable method of calculation useArticle 7. SeverabilityIf any article, section, subsection, sentence, clause or ptrary to statute, exceedingey General, or otherwise inoperative, suvalidity of the remaining porti