Pub. 3 2021-2022 Issue 2

30 Hao Nguyen General Counsel, ComplyAuto CCPAOpt-Out Requests: Hey CRM, You’re Doing It Wrong! O ne evening over a Zoom call, I asked a friend in law enforcement what the most ridiculous as- signment he received was. Rather than focusing on any one event, he said speeding tickets stood out because of how many times he got this response: “I’m sorry, officer; I didn’t know how fast I was going.” He said it was comical that these folks thought it would work because “ignorance of the law is never an excuse.” I thought it was the perfect line to introduce this article. With the California Consumer Privacy Act (CCPA) now in its second year, the California Attorney General’s office now expects businesses to have a firm grasp on the CCPA. Not only does the CCPA grant consumers the ability to submit to businesses a request to know, to opt- out and delete personal information, businesses should now know how to: 1. Verify the consumer’s request (in which the requirements vary on the type request); 2. Fulfill or reject these requests (while considering if they meet verification requirements or if any exemptions apply); and 3. Notify the consumer that you were processing and have completed the request; 4. Notify any vendor of the request (again, requirements to verify vary on the type of request and now, whether the vendor is a “third party” or a “service provider”) Maybe some leniency was granted by enforcement officials in the beginning when California businesses as a whole were collectively getting their “sea legs” to comply with these laws. But now, as my friend so aptly put it, ignorance of these laws will no longer be an excuse. Of all of the confusing aspects of the CCPA, what has continually stymied both businesses and vendors alike is the definition of the phrase “opt-out.” Specifically, some Customer Relationship Management (CRM) software cannot fulfill these requests correctly and avail you of significant legal liability when receiving an “opt-out” request from you or on your behalf. To fully understand what is happening, you will need to know what an “opt-out” truly is under the CCPA and what the consumer is asking you to do when submitting an opt- out request. Traditional Meaning of “Opt-Out” Before the CCPA, the phrase “opt-out” was most prevalently used in the context of marketing under the federal Telephone Consumer Protection Act (TCPA) and the CAN-SPAM Act, with the former revolving around phone calls and text messages and the latter regarding email advertisements. In both instances, an “opt-out” meant that the consumer no longer wants to be contacted for marketing or promotional purposes. Usually, a text message would have an opt-out function, or an email would have a kind of “unsubscribe” link that removes them from the email list.