The California Consumer Privacy Act of 2018 (CCPA) took effect on January 1, 2020, enacting strong regulations on the collection and retention of the personal information of California residents. Businesses must implement these new regulations in their Privacy Policies and on their websites if they wish to satisfy the new law.
One of the more interesting regulations is the "Toll-Free Number" requirement. This requirement is confusing some businesses as to whether they must include the number since there was a 2019 amendment to this requirement.
Whether or not your company must include a toll-free number rests upon a few key things you'll need to determine. We'll help you figure it all out here.
With the CCPA taking effect earlier this year, all of the regulations under the law came into effect, including the Toll-Free Number requirement.
The CCPA's regulations are extremely tough and one of the key elements of the law is allowing consumers access to their information. The toll-free number is meant to be a method for consumers to invoke their right to request access.
Under Sec. 1798.130(1)(A), businesses that fall under the scope of the CCPA must provide customers "two or more" methods for customers to submit a request to have their information disclosed. To satisfy the law, you must, at the bare minimum, include a "toll-free telephone number." Here is the section in full:
Other methods the CCPA allows include a provided email address, mailing address to send your request to, opportunities for making an in-person request, or offering a link or form on a website. However, at minimum, a toll-free number is required.
This may seem pretty straight forward at first. Unfortunately, an October 2019 proposed regulation changed the scope of this requirement from being an overall requirement to a business-specific one.
What Businesses are Required to Include a Toll-Free Number
First, before you look at whether your type of business must include a number, you must first determine if the CCPA applies to you.
The CCPA was enacted to protect the "privacy rights of California consumers." This means if your company is a business in California or has customers who are from California, you must comply with the CCPA. This applies no matter if you are a small or a large company.
The CCPA's reach doesn't end at the borders of California or the U.S. but also reaches any international company that collects the private information of California residents.
Once you determine whether your company must comply with the CCPA, you can determine whether your specific business is required to provide a toll-free number.
The first requirement is that your business collects the private information of California residents. The second is connected to the type of business you run.
Whether you are required to provide the toll-free number, other additional methods of contact, or are excluded from including the toll-free number depends on how your company interacts with its customers.
Sec. 999.312 of the proposed regulations requires "at least one method offered shall reflect the manner in which the business primarily interacts with the consumer." When a company interacts with customers through a variety of ways (i.e., storefront and online) it must provide a method for each interaction.
How does this apply then to your type of company and whether or not you must provide a toll-free number?
Online Companies With Storefronts
Companies that operate a website but interact with their customers primarily through an actual storefront must include a toll-free telephone number in addition to two other methods. Why though? Let's take a look at Levi's as an example and how it complies with the CCPA.
Levi's is a California-based company that has stores across the world. It also operates a website where customers can purchase products and where it collects private information. Because Levi's collects private information at each of these points, a contact method for each one is required including not only the minimum requirement but two more methods.
Let's break down the submission section and why Levi's included each type of method.
- Levi's offers a way to submit a request by visiting one of the stores (storefront location)
- Links are provided to forms to fill out on the website (operates a website)
- The toll-free number (collects information from California residents)
What then happens if you fall under the CCPA's scope, but are an internet-only company?
In recent years, there has been a huge boom in internet-only companies. Everything is done through the website - ordering, customer support, and the collection of personal information.
These types of companies still collect private information but interact exclusively with their customers through the website. Are they still required to provide a toll-free number under the CCPA?
Businesses that are online retailers are excluded from the toll-free number requirement. They may be excluded from this type of method, but they must still provide a way for submitting a request. Online retailers must simply provide an email address for consumers to contact regarding their information.
If you only operate online, you can get away with not having a toll-free phone number. But remember you do need an additional method for your customers to contact you through.
How to Satisfy the Toll-Free Number Requirement
For those companies that are required to provide a toll-free number, it's a fairly simple process.
Wells Fargo includes its toll-free number in a separate CCPA Notice under the section titled "How to Make Requests."
Toll-Free Company Packages
What if your company has never had a toll-free number and you are now required to have one?
Since the CCPA was recently enacted, companies are slowly making adjustments to comply with the law, including the toll-free number requirement. For companies that already provided a toll-free number, the CCPA regulation doesn't change much. Companies though that now must include one face a slightly bigger change.
Luckily, there are companies out there taking advantage of this new regulation by creating and offering "toll-free packages" to help companies comply with the CCPA.
These packages often include a toll-free number, storage of calls, creation of web forms, and solutions to help your business obtain and maintain its compliance with the CCPA.
CCPA Toll Free is a website solely directed to providing toll-free numbers and solutions to comply with the CCPA. Its package includes the number, Do Not Track links and a dashboard to track your compliance.
Let's recap what the Toll-Free Number requirement is and whether your business must include one.
The CCPA requires businesses to include methods for consumers to submit a request to disclose their information:
- The toll-free number is the minimum method you must include
- Other methods can also be included, such as email and mailing addresses
Who must include a toll-free number depends on two things:
- Whether you collect the information of California residents
How your business interacts with consumers:
- If you interact with consumers on a website and storefront you must include a toll-free number
- If you are an internet-only company without a storefront you are excluded from the requirement