Ask Reggi Your Question Now

Reggi is the free generative AI assistance for regulatory compliance
Ask a Question

Can I collect cookie information from participants in California? What are the requirements?

Under the California Consumer Privacy Act (CCPA) [4.1], businesses must provide California residents with certain rights regarding their personal information, including the right to know what personal information is being collected about them and the right to opt-out of the sale of their personal information.

Regarding cookie information, the CCPA defines “personal information” as information that “identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household” [4.1]. This means that if the cookie information can be used to identify or link to a particular consumer, it would be considered personal information under the CCPA.

Therefore, if a business collects cookie information from California residents that can be used to identify or link to them, the business must comply with the CCPA requirements. This includes providing notice to consumers about the collection of their personal information, obtaining their consent if necessary, and allowing them to opt-out of the sale of their personal information [4.1].

Under the CCPA, businesses must provide consumers with a “Notice at Collection” that informs them of the categories of personal information that will be collected and the purposes for which the information will be used [4.1]. If the cookie information is considered personal information under the CCPA, the business must include it in the Notice at Collection.

If the collection of cookie information requires the consumer’s consent, the business must obtain that consent in accordance with section 7004 of the California Code of Regulations [4.2]. The methods for obtaining consent must be easy to understand, use language that is easy for consumers to read and understand, and avoid language or interactive elements that are confusing to the consumer [4.2].

Internet Privacy Requirements

In addition to the CCPA, businesses collecting personally identifiable information through a commercial website or online service from individual consumers who use or visit the commercial website or online service and who reside in California must comply with the provisions of Section 22575 and 22576 of the California Business and Professions Code [2.1][2.2][2.3].

Conclusion

If the cookie information collected by a business can be used to identify or link to a particular California resident, the business must comply with the CCPA requirements and the Internet Privacy Requirements. This includes providing a Notice at Collection that includes the cookie information, obtaining consent if necessary, and allowing consumers to opt-out of the sale of their personal information. The methods for obtaining consent must be easy to understand and avoid confusing language or interactive elements.

Source(s):
Jurisdiction

California