Data Collection, GDPR, and CCPA for Content Creators with Danielle Liss

So this is something that's come up. People are familiar with it. It's always hard to know, like how official do I take this? Like on the spectrum of business official, do I spend thousands of dollars trying to figure this out? Do I copy and paste something in my privacy policy? Do I need to do other stuff? So what is CCPA and kind of what's going on in that world right now?

Okay, so I'm going to give you a little bit of history before I get into defining it. So what we have seen in terms of data collection and data privacy I think is something a lot of people are familiar with. And we're used to looking at it from kind of the big guys. Right. Facebook, Amazon, Google, they're the ones who I think gets get the attention for what are they doing with our stuff?

So our stuff being our data, like the information they have on us?

Yes. You just think about, didn't Facebook just recently turn off facial recognition unless you say it's okay?

Yeah, something like that. I don't. Yeah, I don't remember specifically.

I think that's kind of some of the things that are coming from it. People are a little bit concerned about the power of artificial intelligence. They're concerned about how their data is being used. And I think that there have been perhaps some suspicious activities in the past based upon people's data. So what we are seeing a lot of right now in terms of legislation is places are trying to give people instead of companies a little more control over what happens with their data and to let them know that there are standards in place. And we really started with GDPR in 2018. That was probably the first time a lot of people really thought about it. We knew we needed a privacy policy, most likely, but it was just sort of this thing that people had. And I don't think anyone really thought about why or what was behind it. So 2018, GDPR became effective in May. That was a fun time.

Can you remind people, for those who either forgot or weren't involved at that time, what GDPR is?

Sure. It's the General Data Protection Regulation and it is the European Union's answer to data control. And the goal of that legislation was exactly what I said, that idea of people need to understand and have control over what happens. So that was kind of our first foray into dealing with it. Now, even though it's an EU law, depending upon who your audience is and what you're collecting, data wise, a lot of US companies still needed to be GDPR compliant. So there was this Period in May of 2018, where everybody's like, why am I getting all these privacy policy notices? And I'm like, that's my life right now. And so we were all trying to update privacy policies, understand if it was going to impact us. And it seemed like this massive ordeal. Now, if you're a company like Amazon or Facebook, it has been a massive ordeal. I think that they find, I believe it was Amazon, like hundreds of millions of dollars for violations. I can't remember what the Facebook find was, but it's like they're the ones that they're going after presently.

Right.

Then we now have in the US sort of reactions to that. And CCPA is one of those. So because we don't have a federal law related to data and privacy. And I'm going to put out this with a very hopeful yet because I really, really want one.

It makes your job a little bit easier. And everybody who's creating content online or running any business online, it really would.

Because quite honestly, for companies that are local, it might not be as much of an impactful area. But for bloggers, you've got people from everywhere potentially looking at your site. So you got to have all the things in there. So it's really hard to keep track when you've got to deal with state after state with different legislation. And that's kind of what we're dealing with now. California was really, and California honestly is often at the forefront of legislation. They are often the first state to do things. They were the first state who had required privacy policies in the first place. And so CCPA is the California Consumer Protection Act. And the goal there, it's very similar to GDPR except that it's opposite where they wanted people to have more knowledge, understanding and transparency of how their data was being used. And the reason I say it's opposite. So GDPR was opt in. So you had to give permission for somebody to be able to use your data. Whereas California is opposite in that it's opt out. So there you notify people what you are doing with the data and they can then say, oh no, don't do that. So you've got to have some different mechanisms, which. That was my favorite part of this whole thing was like, why? Yeah, just be. Couldn't you just copy that now?

Okay, yeah, like idea being. It's a totally separate. It's the same. The spirit of the law is the same, but the way that they're pulling it off is completely different.

Yep.

So people are having to create a new process potentially in order to adhere to the regulation.

Exactly. And they also have certain definitions in there that I think people found confusing. So they said, if you sell data, then you have to be compliant. If you fall under the category of business that we define business to mean. And everybody's like, I don't sell data. Except when you read their definition, it's literally anything that happens with the data, it's basically sharing, giving it to another partner. Like, think of whomever does your email newsletter. Like, they. They would view that as a sale under the definition. So it became extremely confusing for people saying, I didn't think I needed this, but I guess I kind of do. And the way that they have it defined is you are considered a business under the law if you meet three different criteria. First is if you make $25 billion a year. And quite honestly, I want that for every single person who is listening to this podcast. I don't know if many people are there yet.

Right.

But I want that for them.

Yeah.

The next one is if basically what I call data brokers, like, you are literally the people who are gathering the data and selling it off to someone else. Like that is the type of transactions that you're involved in. Then there's this third area that gets a little more confusing, and it's collecting data from individuals in California, and they set that number at 50,000. So this is where it can become important to start to know who your audience is. Because if you've got 50,000 visitors from California each year, then you do need to be CCPA compliant.

For most people, that's per year, you said.

Yeah. So for most people, it's not. It's a matter of knowing your data, knowing who your audience is, and then knowing what it is you're collecting and who you're sending it to and what the exceptions are. One thing that a lot of folks will say, and I'm on that bandwagon about ccpa, is it was a hastily cobbled together piece of legislation. They made a lot of changes to it, and there are changes that are going to go in next year. So if you're familiar with California's elections at all, California does ballot initiatives. So a ballot initiative passed that is now going to be called cpra, which is the California Privacy Rights Act. I know there's.

It's the evolution of ccpa.

Yes. It's essentially amendments, and people say that it expanded it. However, it's also changing that definition of what is considered a business. So even though there are more things that people need to be concerned with the whole thing that I think most bloggers are looking at is do I count as a business under this? So then it's going to go up to 100,000 California residents. So that's where it really does get a little bit different. So you may be under it now, but you might not have to be next year. My view on it is, if you're already doing it at 50,000, I mean, the hope is your traffic is going to continue to increase and grow. I would keep it. But if you're looking at it now saying, what do I do with this? Just know that it is traffic based, but it does impact what you need to do in terms of you need to give people the ability to opt out and you also need to make sure that you've got the appropriate information within your privacy policy.

Got it. So privacy policy update makes sense. That would be something that you would either go to an attorney to help with or like, if somebody purchased like a template, would that have it? I know that you have businesses, would that have a CCPA or CCP are c. What is it?

I know too many cpra.

Yeah. Block in it. That would cover people for that in the privacy policy.

Yes. I, I can only speak really for businesses because obviously they're templates that I have created. But we do have it in there and we try to make it accessible so that you understand, like, do I actually need this or don't I? Because for privacy policy purposes, it's not that over the top. It's really like the goal of your privacy policy is always going to be more or less, what information do you collect, what information do you share, who do you share it with and how are you using it? It's how people need to understand from your privacy policy what's happening. The way that the law is structured is they have different categories that things fall into. And it might be information like your name and address, or it might be things that they consider sensitive information, which are things like gender, employment status, things like that. Then it gets into things that I don't think most bloggers are into, but I reserve the right to change that opinion. Where it's like the biogenetic type information.

Sure.

And I think that would be like.

Probably not a lot of bloggers collecting.

That scam type of things, I assume. So there's that type of piece of it where you're just like, I definitely don't collect those things. So it's really just a matter of knowing. And I think that that's really what so much of the Privacy laws are about. You need to have a basic understanding of what is installed on your site and what you're collecting and what you're doing with it. And that might be through plugins, things that you know you're directly collecting. Like, let's say you've got a digital product, you're getting somebody's payment information at some point in that process. So where do you get it? Most of the time I'm going to say the general big two are Stripe and PayPal. So it's going to be Stripe and PayPal who are processing. So you're technically never getting that information. You're getting the money and you might get like last four digits or some other transaction information, but you're not actually holding financial information for them. So in that case, you just let people know. I use the following people to prompt process as payments come in and here's what happens to it.

Got it. And the numbers. Would you just look at Google Analytics for that? Like, hey, in the last 12 months or I suppose it's on an annual basis. But generally speaking, a site like WP Tasty probably wouldn't have 100,000 or maybe even 50,000. It's a smaller traffic site, whereas pinch of VM would. So that would be. If we look at Google Analytics and see, hey, we had 50,000 users visitors from California, then we would be considered a business that would be doing business in California. Is that how it works?

Then you would be considered a business who has to follow the law there because it's the California residents that you're looking at. So if you've got 50,000 California folks who have visited and I do say just dive into Google Analytics and see what you have. Because I think that for some folks, like, if you have a very, very localized audience and you're not in California, so if you have like a little bit of traffic from there, and even though you have a large, larger amount of traffic that's coming in depending upon where that falls, then you might not need to be as concerned with it. Like if you know you've got like mostly east coast or wherever the case might be, then it might be less of a concern. I always say have it on your radar because unfortunately, without federal privacy legislation in place, again, please let me have that. We are also going to be looking at other states because as I said, California is usually first. So we have other states that are probably going to be enacting similar laws and they might not have the exact same definitions. So it's going to be interesting to Try to keep track of. And I think that's. And I want to put out there. I don't want people to feel overwhelmed by this if it is. I don't think that the purpose and the spirit of these laws is to come after bloggers. I don't think that that is the case now. There is always going to be mechanisms for reporting problem sites and things like that. However, I think it's important to make sure that to the best of your ability, you have followed and tried to keep track. And then just most of the time, the legislation is going to go into effect, you know, beginning of the year. So just kind of take a look at it, say maybe November, December, where can you find resources on what is going to be taking effect? Or if you've already got policies and templates that you've purchased, do they offer updates that make it easy for you to find out what's happening?

Yep. And then what is actually. What do you actually do do? Like, what is the. You have this update in your privacy policy. But like, then you. You're actually having to do something to adhere to the regulations. What is it that you're actually doing?

Usually you're giving people rights to do certain things. So they can. With California, for example, they have a specific format that they have to follow where they can send in a request to find out what information you have, what you've done with it. And that's somewhat similar to gdpr. So with gdpr, the right to delete is a good example of one of the things that they offer. With the right to delete, you could send in a request and say, I basically want my data wiped from your servers. I want this to go away. I one time had somebody from the EU send me that request for gdpr. And I was like, okay, I'm happy to do that, but you're going to lose access to the thing that you purchased. Do you still want to move forward? So sometimes it can be a conversation. It's like, I'm happy to remove it from an email list, like any type of marketing materials, but do you want to lose access to this thing? Like, and if they've already downloaded what they've got, fine, then it's not a big deal. But it's just sometimes you need to make sure you know exactly how that might impact them because. And you want to be transparent about that. It's like, I am happy to do this for you. I want to honor your request. However, here's the thing. And so. And your privacy policy will also have in there. Like kind of how they exercise those specific rights. It's usually going to be an email or sometimes you can include a mailing address. The other piece for California is you need to have something that's essentially if you need to be CCPA compliant, there should be a button on the site that says do not sell my information. And most websites have it. California residents colon, do not sell my information. Um and then they can click on the site. And it all depends on what's truly being sold and if it falls into the definition of a sale. The most common thing right now I think is for ad networks. Um, and most of the ad networks they're actually providing code for whatever button they have that allows people to opt out of it.

And would that be is that only displaying to California residents? Do you know?

I'm honestly that I don't know because I haven't played with that piece of the technology. I think that for it may but I that I, I'm going to have to get say I'm not certain there.

Okay. Yeah. Cause I'm curious. I, I, it might be one of those things where it's like you buy a red car and then you suddenly see red cars everywhere. Where like I'm, I feel like I'm so I just essentially see cookie. You know, except cookies. Yeah, except cookies or and remember in.

2018 that was the thing. Like they, the cookie bars weren't there in 2018. Like in my mind, cookie bar meant a very tasty dessert. Not exactly like this thing that has become ubiquitous at this stage. And GDPR really is the reason why we have come to see those cookie bars and just not even think about it. And people really, really concerned when they had to first install those. I don't know if you remember that people were just like that's going to drive traffic away. That's not going to work. That's going to be awful. And now it is as commonplace as can be. Just okay. People go on their way.

Yep. So takeaways from that when you when we're thinking about CCPA and cpra. Did I get that?

Got it. Good job.

Is you need to make sure that number one, if you there's those three checks where 25 million or over. It's probably not going to be a lot of people listening to it. And then the second one was Remind me what that one was.

Basically the data brokers.

Okay. Like somebody who's brokering data. Probably not anybody who's listening to this podcast. The third one, high potential for people listening to the podcast, which would be in a year. Are you getting over a hundred thousand users, visitors, California residents who are using your site? If that's true, technically you need to be CCPA compliant or in 2023. Is that when the CPRA will pass?

Yeah, 2023, it's January 1st is when it's effective. I think I've seen some things that say it's going to be retroactive, but my view on being retroactive, like there are expansions to the ACT that are in there. So I think that's really the bigger concern. But right now, if you're already CCPA compliant because you've got 50,000, you're. You should be good to go for the a hundred thousand. Except for like I know that it. For example, one of the things that they've created a new category for is like certain sensitive information like your Social Security number. And I am going to. I'm going to wager that most food bloggers are probably not getting anywhere close to collecting things like in that category. Right. So it may be that there will be some updates that you would make to your privacy policy, but it's going to be. It's really the thresholds that I think are going to be the most concerning for most folks because it's really complying. Isn't that big of a deal. What's the bigger deal is do I need to. That's usually the thing I think more people are getting hung up on.

Yep. So I can see with pinch of yam, when I pull up our privacy policy, additional rights of California residents. I'm sure you updated this for us, but. Right to access, right to delete, deletion, right to non discrimination, how to submit a verifiable consumer request. And then there's actually a Nevada one. So is that an example of like another state that has created their own sub requirements?

I'm in Nevada, so I can kind of, you know. Yeah, I can pick on us. So the Nevada requirements piece, it's a nice to have in there and it is something that I've got in the template over at businesses, but I think that for most people it isn't necessarily applicable for blogging because the way they've defined sale and selling data to be different than what's in California again, I love when the definitions of the same word can be completely different than legislation.

Totally makes your job.

Yeah, it's fun. But there are certainly other balls that are pending that I think are going to be a little more similar to California and that's really going to be the biggest thing for the next year that's kind of what's on my radar is okay who am I watching now what are we going to be updating in Q4 so that we are ready for any 2023 effective dates?

Yep that makes sense and so if people are working with an ad network the nice thing is that those ad networks as far as you're aware are building that option in being that they are involved with data and the use of data on a marketplace and selling that but they have that built in and whether it's triggering for based on geolocation or not TBD but good to know.

Yes as far as I have seen they have been providing great stuff so when I work with people on the law firm side as opposed to the template side usually one of my first questions to them is which ad manager are you using and when they tell me it's like okay here's the information we're going to pop in for that Got it. Sa.