The state of California with a cookie jar with a lock on it

Navigating CCPA’s Impact on Your Brand

By: Pete Capp

In the recent film The Social Dilemma they state, “if you are not paying for the product then you are the product.”

As technology continues to make it easier for consumers to learn, connect and shop, it also makes it easier for brands to collect data. With privacy becoming more and more of a concern for these ever-connected consumers around the world, the Global Data Protection Regulation (GDPR) in the EU and recently the California Consumer Privacy Act (CCPA) in the U.S. were born as a way to regulate the treatment of personal data collection and its usage by brands. If you’re a California-based brand, you’re probably well aware of CCPA but these new regulations and the costly fines associated with them are impacting more than just those brands operating in California. So how do you know if CCPA impacts your business and how can you swiftly navigate these changes correctly? ­Let’s start with some basics.


What exactly is CCPA?

The California Consumer Privacy Act (CCPA) which began in January 2020, is a game-changer for the United States and follows the growing consumer data privacy trend set by the implementation of the GDPR. Under the CCPA (nicknamed California’s GDPR), California residents have the right to access any personal information that is obtained by a website and its cookies, either to have it deleted or to opt out of its “sale” to other third parties. Compliance under CCPA for data collection of personal information stored on a website database is fairly straightforward for California users. For businesses, if you are for-profit and have customers in California you are required to comply with these rules if you:

  • Earn at least $25 million in revenue per year
  • Own personal data for more than 50,000 consumers, and
  • If half of that revenue comes from the selling of consumer data.


What are cookies and why are they important?

Cookies are typically small text files that are assigned identifiers (IDs) and stored on your computer’s browser. These cookies are created when you use your browser to visit a website to track your interactions within the site. Some of their uses are remembering a registered login, helping you resume where you left off (shopping cart, etc.), site preferences and many other functions.

On the other hand, third-party cookies are installed by other product programs, typically ad tech for other advertising purposes like retargeting that are not directly controlled by the site owner. To advertisers, publishers and ad tech companies alike, this isn’t new news that third-party cookies are facing scrutiny with the continually growing pro-consumer privacy trend in the United States and abroad. These cookies can be used to track a bit more of the user’s activity across sites and over longer periods of time. While the term “third-party cookie” has emerged relatively recently, the technology behind it was created much longer ago and has been around since the ’90s.


What website updates are companies making to become compliant?

While browser companies like Firefox, Safari and soon Google Chrome are already taking the initiative to phase out cookies, there is a need for companies to take immediate action to avoid fines. So, what steps should brands take to change their third-party cookie practices today on their websites? Under CCPA, companies need to offer more comprehensive choices to consumers. These options take the form of passive and active cookie banners that disclose information about what cookies are being stored and their purposes. Cookie banners and privacy policy updates are not explicitly required but are becoming common practices on corporate websites. Most cookie banners fall within these three categories:

  • Notice Only -This banner discloses to visitors that the website uses cookies but does not give the user any direct control over the use. Some banners might even provide information on how to disable cookies directly within the browser itself.

  • Notice/Opt-In - This type of cookie banner will disclose to a website user that the website would like to deploy cookies. The user accepts the use of cookies by either continuing to view the website or by an action of clicking accept within the banner.

  • Notice/Opt-Out - An opt-out notice cookie banner discloses to a website user that the website deploys cookies and provides the user with a mechanism for disabling the use of cookies on the website in the future. This might be a single “opt-out” or a more granular option for opting out of some types of cookies (advertising cookies, etc.).

In addition to cookie banners, companies need to have a “Do not sell my personal information” link provided which allows users to request or delete any personal information being stored by a brand. Brands must facilitate and respond to at least two types of submission requests: the first is a toll-free phone number for users to call and the second is a web-based form. This process is used to verify the authenticity of the requesting user.


What if your brand’s website is not compliant?

A brand can be penalized for failing to maintain a CCPA privacy policy, not responding to a consumer request for their data, not providing a notice when collecting personally identifiable information (PII) or selling data without an opt-out statement. First, your brand will receive a 30-day warning. If the violation isn’t rectified, the fines can be up to $7,500 per intentional violation and $2,500 per unintentional violation (a violation referring to one consumer). The enforcement of CCPA took full effect on July 1st, 2020. There are, however, a lot of discussions to delay enforcement to January of 2021 due to the pandemic.

It goes without saying that privacy is a major concern among website users these days and it’s safe to say that these types of regulations are here to stay. In fact, more states will undoubtedly follow suit in the very near future, but to what extent and how far each state will go is TBD. There are also strong possibilities that as various states pass their own unique data privacy laws (there are several states in this process), that the federal government will introduce national legislation to ease the burden of a state-by-state mosaic of privacy laws. It pays to understand what is to come so your brand can get in front of it.


Hoffman York is a full-service advertising and marketing communications agency with experience helping clients succeed. HY provides award-winning creative solutions, paid media, content creation, public relations, digital strategies and development, as well as research and analytics. To learn more about how HY can help your brand succeed, contact us at [email protected]. Or, click here to see a gallery of our work. 


Pete Capp, Lead DeveloperAbout the Author:

Lead Developer Pete Capp provides leadership and oversight to our team of digital producers and developers while supporting and providing technology strategies for client digital work. Pete has garnered over 17 years of experience working on projects for companies like Yamaha Outboards, Wisconsin Lottery, Mercury Marine, Wahl Clipper Corporation and Harley-Davidson.

News Article

It’s alive: Halloween 2020 will persevere thanks to millennials

Halloween spending may be different this year but spending there will be. And we know that nobody celebrates spooky season quite like millennials. Here are three tricks to help marketers succeed in this year’s very different Halloween.

Read More
News Article

How to ‘Design Think’ Your Brand Out of a Pandemic

Design thinking becomes even more important when we need to solve new challenges caused by some of the lasting impacts of COVID. Here are the steps we follow at HY for our clients.

Read More
News Article

History Shows Us Creativity is Key During a Recession

Now more than ever, consumers are craving entertainment, inspiration and normalcy – not just another “in these troubling times” stock video montage. As advertisers, it is up to us to be creative within these new constraints while serving our clients and keeping people interested. 

Read More

Say hello.