Ask Reggi Your Question Now

Reggi is the free generative AI assistance for regulatory compliance
Ask a Question

Can I use third-party marketing automation tools that collect personal information in California? What are the requirements?

Using Third-Party Marketing Automation Tools that Collect Personal Information in California

If you are using third-party marketing automation tools that collect personal information in California, you must ensure that you comply with the California Consumer Privacy Act (CCPA) [1.1].

Under the CCPA, businesses that collect personal information from California consumers must provide a Notice at Collection that informs them of the categories of personal information to be collected, the purposes for which the information will be used, and whether the information will be sold or shared [1.3]. If a third-party tool collects personal information on behalf of a business, the business is responsible for ensuring that the tool complies with the CCPA’s requirements. This includes providing consumers with a Notice at Collection and responding to consumer requests to delete, correct, know, opt-out of sale/sharing, and limit the use of their personal information [1.1][1.3].

Additionally, businesses must ensure that their collection, use, retention, and/or sharing of a consumer’s personal information is reasonably necessary and proportionate to achieve the purpose(s) for which the personal information was collected or processed [1.2]. The purpose(s) for which the personal information was collected or processed shall be consistent with the reasonable expectations of the consumer(s) whose personal information is collected or processed [1.2].

In summary, if you are using third-party marketing automation tools that collect personal information in California, you must ensure that you comply with the CCPA’s requirements, including providing a Notice at Collection and responding to consumer requests to delete, correct, know, opt-out of sale/sharing, and limit the use of their personal information. Additionally, you must ensure that your collection, use, retention, and/or sharing of a consumer’s personal information is reasonably necessary and proportionate to achieve the purpose(s) for which the personal information was collected or processed and consistent with the reasonable expectations of the consumer(s) whose personal information is collected or processed.

Source(s):
Jurisdiction

California