What is Considered Personal Information Under CCPA?

What constitutes personal information under the CCPA?

Under the CCPA, any information that can identify, relate to, describe or be associated with a consumer or household is considered personal information. This includes all types of identifiers such as real names, aliases and social security numbers as well as indirect ones like cookies, beacons, pixels, IP addresses, account names and phone numbers.

Furthermore, the CCPA’s definition of “person information” encompasses data that is “described,” or a description of an act or habit. For instance, if you have a prescription for a drug with specific details about its use, strength, manufacturer and sale price on it, those dosages and other characteristics could constitute personal information even if no individual has ever been identified or de-identified.

What Does this Mean for Businesses?

The CCPA’s definition of personal information is broad, but there are some things businesses should be mindful of to avoid getting into legal trouble. Most importantly, be aware of what types of personal data you are collecting, using, selling or sharing so that you can comply with the law.

First Building Block: What Necessary Connection Must Exist Between Information and Customers or Households?

This building block is essential in determining what personal information is and whether it falls under the CCPA. For instance, an internet service provider that only collects IP addresses from customers may not qualify as a business under the CCPA unless you have some internal tools that enable linking those IP addresses to individual consumers or households.

However, if you can tie those IP addresses to a customer’s name, address, phone number, email and payment information, then this data could potentially qualify as personal information under the CCPA.

As with any data, the CCPA’s definition of personal information requires that it can be used to identify a consumer or household in some way. The best way to guarantee this happens is through careful due diligence and analysis, such as linking it to an ID card number or phone number for identification purposes.

Additionally, if you can identify the individual responsible for collecting data (e.g., phone number or email address), then you may have a legal obligation under CCPA to provide that information if required by law.

Household Data: The CCPA’s definition of household data has sparked much debate over the years. Some critics have argued that it is too broad, while others advocated for a more specific explanation of what household data is and how to enforce it effectively.

In the end, businesses must decide what constitutes personal information under the CCPA. While it remains uncertain exactly what that law requires of businesses, a common approach to avoiding potential issues with the CCPA is making sure you only collect and use personal information from California residents.