Navigating the CCPA in the Automotive Industry

The CCPA, or the California Consumer Privacy Act, was a privacy law signed by California Governor Jerry Brown in June of 2018 becoming effective January 1st of 2020. The law is meant to enhance current privacy rights for consumers in California. Signaling a large shift in how consumer data is handled, the Act requires businesses – including automotive dealers – to change the way they collect personal data and information from their consumers.

What the CCPA Means for Consumers

The central goal of the CCPA is for California consumers to have greater control over the personal information that is gathered about them from companies and other entities. This “personal information” can be anything from their real name, alias, postal address, to their email address, social security number, driver’s license number, and passport number.

With the Act, consumers earn the right to:

  1. Know what personal information is being collected about them
  2. Access that same information
  3. Know if their personal information is disclosed, and with whom
  4. Know if their personal information is sold and the right to opt out of the sale
  5. Receive equal service and price whether or not they exercise their privacy rights

What the CCPA Means for Automotive Dealers

The reality that faces automotive dealers is that they collect personal information about consumers every single day. From a prospect entering their information into a dealership lead form to new customers handing over financial information for the purchase or lease of a car, it’s imperative that dealers have a strong understanding on all of this data to comply with the new law.

In the fine print, the CCPA applies to any business that:

  1. Has annual gross revenues in excess of $25 million;
  2. Possesses the personal information of 50,000 or more consumers, households, or devices.
  3. Earns more than half of its annual revenue from selling consumers’ personal information.

It’s important to note that not all personal information gathered by dealers are subject to the jurisdiction of the CCPA. For example, personal information collected under various privacy regulations like the Driver’s Privacy Protection Act of 1994 is not covered by the CCPA. Outside of financial information needed for the sale of car, the CCPA has a greater effect on the marketing, sales, and customer service side of personal information.

How to Stay Ahead of the CCPA as an Automotive Dealer

To stay ahead of these new privacy regulations, dealers need to be proactive on how they store and use the information they have on their consumers. Here are some simple steps you can take to make sure you are ready for the CCPA:

  1. Look over the vendors and third-party relationships you have to ensure that all consumer data for your dealership (CRM, DMS, etc.) is carefully examined and accounted for.
  2. Provide opt-out instructions and updated text about data collection policies on your website and other data gathering channels. Note that a toll-free phone number is mandatory, whereas a web form or email can be used as a second method for unsubscribing.
  3. Update your privacy policy to include all information your dealership is gathering about your consumers, including but not limited to, sources of how data is gathered, what the data is being used for, and what third parties might be involved with said data.
  4. Check that your dealership has a system in place to respond, address, and manage a consumer request. For instance, dealerships need to have a process that is technically feasible for consumers to access their data in a readily useful format.

It’s important to stay up to speed with the CCPA as the act will likely change as time goes on. When all is said and done, we recommend dealerships consult with their legal counsel to discuss the new compliance obligations that would impact their general dealership operations, data inventory, and customer relationships.

Still confused on how the CCPA could affect your dealership? Contact us.