Ask Reggi Your Question Now

Reggi is the free generative AI assistance for regulatory compliance
Ask a Question

Can I use third-party social media tools that collect personal information in California? What are the requirements?

Based on the context documents, if you are using third-party social media tools that collect personal information in California, you must comply with the California Consumer Privacy Act (CCPA) [2.2][2.3].

Restrictions on the Collection and Use of Personal Information [2.1]

According to Civil Code section 1798.100, subdivision (c), a business’s collection, use, retention, and/or sharing of a consumer’s personal information shall be reasonably necessary and proportionate to achieve the purpose(s) for which the personal information was collected or processed. The purpose(s) for which the personal information was collected or processed shall be consistent with the reasonable expectations of the consumer(s) whose personal information is collected or processed. The consumer’s (or consumers’) reasonable expectations concerning the purpose for which their personal information will be collected or processed shall be based on the relationship between the consumer(s) and the business, the type, nature, and amount of personal information that the business seeks to collect or process, the source of the personal information and the business’s method for collecting or processing it, the specificity, explicitness, prominence, and clarity of disclosures to the consumer(s) about the purpose for collecting or processing their personal information, and the degree to which the involvement of service providers, contractors, third parties, or other entities in the collecting or processing of personal information is apparent to the consumer(s).

Requirements for Businesses Collecting Large Amounts of Personal Information [2.3]

If you are a business that collects personal information of 10,000,000 or more consumers in a calendar year, you must compile and disclose the number of requests to delete, correct, know, opt-out of sale/sharing, and limit that the business received, complied with in whole or in part, and denied. You must also disclose the median or mean number of days within which the business substantively responded to these requests. This information must be disclosed within your privacy policy or posted on your website and accessible from a link included in your privacy policy.

Construction With Other Laws [3.4]

Nothing in the CCPA shall be construed to deny or limit any right of privacy arising under Section 1 of Article I of the California Constitution.

In summary, if you are using third-party social media tools that collect personal information in California, you must comply with the CCPA and ensure that your collection, use, retention, and/or sharing of a consumer’s personal information is reasonably necessary and proportionate to achieve the purpose(s) for which the personal information was collected or processed, consistent with the reasonable expectations of the consumer(s) whose personal information is collected or processed. If you are a business that collects personal information of 10,000,000 or more consumers in a calendar year, you must also comply with additional requirements for businesses collecting large amounts of personal information.

Source(s):
Jurisdiction

California