The CCPA/CPRA's Toll-Free Number Requirement

The California Consumer Privacy Act of 2018 (CCPA) took effect on January 1, 2020, enacting strong regulations on the collection and retention of the personal information of California residents. It was further amended and expanded by the California Privacy Rights Act (CPRA).

Whether or not your company must include a toll-free number rests upon a few key things you'll need to determine. We'll help you figure it all out here.

The CCPA/CPRA's regulations are extremely tough and one of the key elements of the law is allowing consumers access to their information. The toll-free number is meant to be a method for consumers to invoke their right to request access.

Under Sec. 1798.130(1)(A), businesses that fall under the scope of the CCPA must provide customers "two or more" methods for customers to submit a request to have their information disclosed. To satisfy the law, you must, at the bare minimum, include a "toll-free telephone number." Here is the section in full:

The toll-free number can also be used as a method to control your "Do Not Track" signals that are required under California law to be included in your Privacy Policy.

Other methods the CCPA (CPRA) allows include a provided email address, mailing address to send your request to, opportunities for making an in-person request, or offering a link or form on a website. However, at minimum, a toll-free number is required.

What Businesses are Required to Include a Toll-Free Number

First, before you look at whether your type of business must include a number, you must first determine if the CCPA (CPRA) applies to you.

The CCPA's reach doesn't end at the borders of California or the U.S. but also reaches any international company that collects the private information of California residents.

The first requirement is that your business collects the private information of California residents. The second is connected to the type of business you run.

Whether you are required to provide the toll-free number, other additional methods of contact, or are excluded from including the toll-free number depends on how your company interacts with its customers.

Sec. 999.312 of the proposed regulations requires "at least one method offered shall reflect the manner in which the business primarily interacts with the consumer." When a company interacts with customers through a variety of ways (i.e., storefront and online) it must provide a method for each interaction.

How does this apply then to your type of company and whether or not you must provide a toll-free number?

Online Companies With Storefronts

Companies that operate a website but interact with their customers primarily through an actual storefront must include a toll-free telephone number in addition to two other methods. Why though? Let's take a look at Levi's as an example and how it complies with the CCPA (CPRA).

Levi's is a California-based company that has stores across the world. It also operates a website where customers can purchase products and where it collects private information. Because Levi's collects private information at each of these points, a contact method for each one is required including not only the minimum requirement but two more methods.

This is why in the Levi's Privacy Policy there are multiple ways to submit a request:

Let's break down the submission section and why Levi's included each type of method.

• Levi's offers a way to submit a request by visiting one of the stores (storefront location)
• Links are provided to forms to fill out on the website (operates a website)
• The toll-free number (collects information from California residents)

What then happens if you fall under the CCPA/CPRA's scope, but are an internet-only company?

Internet-Only Companies

In recent years, there has been a huge boom in internet-only companies. Everything is done through the website - ordering, customer support, and the collection of personal information.

These types of companies still collect private information but interact exclusively with their customers through the website. Are they still required to provide a toll-free number under the CCPA (CPRA)?

No, actually.

Businesses that are online retailers are excluded from the toll-free number requirement. They may be excluded from this type of method, but they must still provide a way for submitting a request. Online retailers must simply provide an email address for consumers to contact regarding their information.

Dollar Shave Club is an online retailer without any storefronts that does all of its business online. Customers subscribe to receive razors and communicate through the website. In its Privacy Policy, instead of a toll-free number, an email address is provided for customers to contact to submit their requests:

If you only operate online, you can get away with not having a toll-free phone number. But remember you do need an additional method for your customers to contact you through.

How to Satisfy the Toll-Free Number Requirement

For those companies that are required to provide a toll-free number, it's a fairly simple process.

Under the CCPA (CPRA), and the California Online Privacy Protection Act (CalOPPA), businesses that collect the private information of California residents must inform their users of this collection. This is done through a Privacy Policy.

A Privacy Policy is your company's disclosure to customers about how their information is collected, why it is collected, protection of the data, and your relationships with third-parties that may include the transfer or sharing of their data.

The CCPA (CPRA) doesn't say exactly where the toll-free number should be included in a Privacy Policy. We would recommend including it somewhere that relates to either California residents, how consumers can exercise their rights to access their information and always in a general contact clause.

Wells Fargo includes its toll-free number in a separate CCPA Notice under the section titled "How to Make Requests."

In-N-Out Burger includes its toll-free number in the California Resident section of its general Privacy Policy and calls it the CCPA phone line:

Macy's collects the information of California residents through its website and storefronts. Macy's toll-free number is included in its general Privacy Policy under the Contact Us clause. Live chat, email, Facebook Messenger and Twitter options are also available for communication:

As you can see, most businesses do put this toll-free number in some sort of clause dedicated to California residents, but some do take a more general route when it comes to placement within the Privacy Policy.

Toll-Free Company Packages

What if your company has never had a toll-free number and you are now required to have one?

Since the CCPA (CPRA) was enacted, companies are slowly making adjustments to comply with the law, including the toll-free number requirement. For companies that already provided a toll-free number, the CCPA (CPRA) regulation doesn't change much. Companies though that now must include one face a slightly bigger change.

Luckily, there are companies out there taking advantage of this new regulation by creating and offering "toll-free packages" to help companies comply with the CCPA (CPRA).

These packages often include a toll-free number, storage of calls, creation of web forms, and solutions to help your business obtain and maintain its compliance with the CCPA (CPRA).

CCPA Toll Free is a website solely directed to providing toll-free numbers and solutions to comply with the CCPA (CPRA). Its package includes the number, Do Not Track links and a dashboard to track your compliance.

Summary

Let's recap what the Toll-Free Number requirement is and whether your business must include one.

The CCPA (CPRA) requires businesses to include methods for consumers to submit a request to disclose their information:

• The toll-free number is the minimum method you must include
• Other methods can also be included, such as email and mailing addresses

Who must include a toll-free number depends on two things:

• Whether you collect the information of California residents

• How your business interacts with consumers:

  • If you interact with consumers on a website and storefront you must include a toll-free number
  • If you are an internet-only company without a storefront you are excluded from the requirement

If you need to have a toll-free number, include it at minimum in your Privacy Policy and make it easily accessible.