Nonprofits and the CCPA

Nonprofits and the CCPA

You may think of the California Consumer Privacy Act (CCPA) as a law that applies to big businesses and social media companies. But have you noticed that the CCPA actually contains two definitions of "business?"

The CCPA's main target is indeed large, profit-making businesses: for example, those with over $25 million in annual revenues. But the act's second definition of "business" encompasses any entity that controls or is controlled by a business.

This second definition significantly broadens the CCPA's scope and means that, in some cases, the act could apply to nonprofits.

Read on to find out if your nonprofit could be covered by the CCPA, and, if so, what you need to do to comply.


The CCPA's Two Definitions of "Business"

Let's compare the CCPA's two definitions of "business," and consider how these might apply to a nonprofit.

Core Definition of "Business"

Here's the CCPA's core definition of a "business," at §1798.140 (c) (1):

California Legislative Information: CCPA - Definition of Business - Version 2

Let's break that down. The CCPA defines a "business" as any legal entity that:

  • Operates for profit
  • Does business in California
  • Determines the purposes and means of the processing of personal information (decides how and why to process personal information)
  • Fulfills one or more of the following characteristics:

    • It has annual gross revenues of more than $25 million
    • It annually buys, receives for commercial purposes, sells, and/or shares for commercial purposes, the personal information of at least 50,000 consumers, devices, and/or households, or
    • It derives more than 50 percent of its annual gross revenues from selling consumers' personal information

Entity That Controls or is Controlled by a Business

Let's look at the second part of the CCPA's definition of a "business," at §1798.140 (c) (2):

California Legislative Information: CCPA - Definition of Business - Controlled or shares branding

This second part of the CCPA's definition applies to "any entity," whether it operates for profit or not, as long as it either controls a business or is controlled by a business, and shares common branding with the business.

What does "control" mean in this context? An entity controls or is controlled by a business if:

  • It owns or is owned by the business
  • It has the power to vote, more than 50 percent of the outstanding shares of any class of voting security of the business
  • It has control over the election of the majority of directors or similar individuals, or
  • It has the power to exercise a controlling influence over the management of a company

Common branding means sharing a name, servicemark, or trademark.

In conclusion, a "business" can be the for-profit entity described at §1798.140 (c) (1) of the CPPA, or any entity, including a nonprofit, that fits the description at §1798.140 (c) (2) of the CCPA.

When Might a Nonprofit Be a Business?

When Might a Nonprofit Be a Business?

There are several scenarios in which the CCPA might apply to nonprofits. For example:

  • A nonprofit with a for-profit subsidiary that qualifies as a "business"
  • A nonprofit entering into a joint venture with a CCPA-covered business
  • A nonprofit engaged in commercial activity

Nonprofits with for-profit subsidiaries, or nonprofits that are subsidiaries of CCPA-covered businesses, should consider whether they fall under the CCPA's jurisdiction.

Nonprofits that are not part of a business but that are engaged in commercial activity should also consider whether they might be subject to the CCPA.

A reasonable point of comparison might be with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), which only applies to "private sector" entities, defined as entities that are carrying out "commercial activity."

Under certain circumstances, nonprofits have been found to be carrying out commercial activity and thus subject to PIPEDA. For example, a hunting club that was run by volunteers but involved exchanging a membership fee for access to exclusive benefits and services.

Obligations Under the CCPA

Obligations Under the CCPA

If you've established that your nonprofit meets the definition of a "business" under §1798.140 (c) (2) of the CCPA, you're required to comply with the same obligations as any CCPA-covered business.

Here's a brief overview of your CCPA responsibilities.

Create a Privacy Policy

Creating a Privacy Policy is one of the CCPA's core obligations. Your Privacy Policy should inform consumers how your nonprofit collects, uses, and shares their personal information.

"Personal information" means any information that "identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household."

Our Privacy Policy Generator makes it easy to create a Privacy Policy for your website. Just follow these steps:

  1. Click on the "Privacy Policy Generator" button.
  2. At Step 1, select the Website option and click "Next step":
  3. TermsFeed Privacy Policy Generator: Create Privacy Policy - Step 1

  4. Answer the questions about your website and click "Next step" when finished:
  5. TermsFeed Privacy Policy Generator: Answer questions about website - Step 2

  6. Answer the questions about your business practices and click "Next step" when finished:
  7. TermsFeed Privacy Policy Generator: Answer questions about business practices  - Step 3

  8. Enter your email address where you'd like your policy sent, select translation versions and click "Generate."

    TermsFeed Privacy Policy Generator: Enter your email address - Step 4

    You'll be able to instantly access and download your new Privacy Policy.

Here's a brief breakdown of the information your Privacy Policy should contain:

  • Information about the CCPA's "right to know" and how consumers can exercise it (we'll be looking at the CCPA consumer rights in more detail below)
  • A list of the categories of personal information you have collected in the past 12 months, plus:

    • The categories of sources from which you collected it
    • The business or commercial purposes for which you collected it
    • The categories of third parties with whom you share it
  • Information about how or whether you sell and/or disclose personal information for business purposes
  • Information about the CCPA's "right to delete" and how consumers can exercise it
  • Information about the CCPA's "right to opt out," including a link to your "Do Not Sell My Personal Information" page (if you have one)
  • Information about the CCPA's "right to non-discrimination, including a statement that consumers will not be discriminated against for exercising their CCPA rights
  • Your contact details and an explanation of how to request more information
  • The date on which the Privacy Policy was last updated

You must update your Privacy Policy every 12 months.

For the full set of Privacy Policy requirements, see our article CCPA Privacy Policy Checklist.

Provide Notice at Collection

Whenever you collect personal information from consumers, you must present "notice at collection." This can be a link to a section of your Privacy Policy, if you prefer.

Your notice at collection must contain:

  • A list of the categories of personal information you are collecting
  • The business or commercial purposes for which you are collecting each category of personal information
  • A link to your "Do Not Sell My Personal Information" page, if you have one
  • A link to your Privacy Policy

Here's an excerpt from Master Dynamic's notice at collection:

Master Dynamic Notice at Collection: Chart with commercial information and internet activity sections

The listed in the left-hand column lists categories of personal information the company collects. The right-hand column lists the purposes for which the company collects the information.

For more information, see our article The CCPA's Four Consumer Notices.

Set Up a Do Not Sell My Personal Information Page

If you sell personal information, you must create a link reading "Do Not Sell My Personal Information" on your website's home page. This link must lead to a form that consumers can use to instruct you not to sell their personal information.

You might not think this applies to your nonprofit. However, if you use cookies on your website, this might qualify as a sale of personal information.

For more information, see our article CCPA: What Constitutes a "Sale" of Personal Information.

Facilitate CCPA Consumer Rights

Facilitate CCPA Consumer Rights

Under the CCPA, consumers (California residents) have certain rights over their personal information. It's your duty to facilitate their rights.

The CCPA consumer rights include:

  • The right to know: You must provide information about the types of information you have collected, used, and shared about a consumer over the past 12 months. Consumers may also request copies of the specific pieces of personal information that your business holds about them.
  • The right to delete: Under certain conditions, you must delete a consumer's personal information.
  • The right to opt out: You must not sell a consumer's personal information if they request that you do not do so.
  • The right to non-discrimination: You must not provide goods or services of poorer quality or at a higher price if a consumer exercises their CCPA rights.
  • The right to opt in (for minors): You must obtain opt-in consent before selling the personal information of minors under the age of 16. You must obtain parental consent before selling the personal information of minors under the age of 13.

For more information, see our article Consumer Rights Under the CCPA.

Set Up Service Provider Contracts

Your nonprofit may share consumers' personal information with other companies, such as marketing companies, analytics firms, and accounts managers. If so, you should ensure these data-sharing relationships are covered by a service provider contract, where appropriate.

Here's how the CCPA defines a "service provider":

California Legislative Information: CCPA - Definition of Service provider

Here's how the CCPA's "service provider" provisions work:

  • Because of the CCPA's broad definition of "sale," businesses risk being deemed to have "sold" a consumer's personal information when they share it with other organizations.
  • If a business fails to allow a consumer to opt out of a sale of their personal information, this is a serious violation of the CCPA.
  • However, if the data-sharing arrangement is covered by a valid service provider contract, the business can share personal information without offering the consumer an opt-out.

A service provider contract must:

  • Clearly set out the purposes for which the service provider may process the personal information it receives from your nonprofit.
  • Prohibit the service provider from using, disclosing, or retaining the personal information for any reason other than those permitted by the contract or by the CCPA.

For more information, see our Complete Guide to CCPA Service Providers.

Protect Personal Information

The CCPA contains two enforcement mechanisms:

  • Civil penalties imposed by the California Attorney General, for an amount of:

    • Up to $7,500 per intentional violation
    • Up to $2,500 per unintentional violation
  • Private legal claims brought by consumers, for an amount of:

    • Between $100 and $750 per consumer, per incident, or
    • Actual damages for any losses caused

The most likely cause of big financial penalties (and the only grounds on which consumers can claim damages) is that you suffer a data breach.

Here's how the CCPA defines a data breach:

California Legislative Information: CCPA - Definition of data breach

This definition of a "data breach" contains the following elements:

  • Unauthorized access
  • Exfiltration
  • Theft
  • Disclosure
  • A failure to "maintain reasonable security procedures and practices"

This means that you must take reasonable care to protect the personal information in your possession. Methods such as encryption in transit and in storage, using security software, and running staff training in data protection will be recognized as reasonable.

Summary

The CCPA may apply to your nonprofit if it controls or is controlled by a CCPA-covered business that shares your branding.

If so, this means you'll have to comply with the full range of CCPA responsibilities, including:

  • Creating a Privacy Policy
  • Providing notice at collection
  • Setting up a "Do Not Sell My Personal Information" page
  • Facilitating CCPA consumer rights requests
  • Setting up service provider agreements
  • Protecting personal information in your control
Robert B.

Robert B.

Legal writer.

This article is not a substitute for professional legal advice. This article does not create an attorney-client relationship, nor is it a solicitation to offer legal advice.