3 ms·

California has the exact same penalty structure in the CCPA: > (b) A business shall be in violation of this title if it fails to cure any alleged violation wit

by petcat 9mo ago

California has the exact same penalty structure in the CCPA: > (b) A business shall be in violation of this title if it fails to cure any alleged violation within 30 days after being notified of alleged noncompliance. Any business, service provider, or other person that violates this title shall be subject to an injunction and liable for a civil penalty of not more than two thousand five hundred dollars ($2,500) for each violation or seven thousand five hundred dollars ($7,500) for each intentional violation, which shall be assessed and recovered in a civil action brought in the name of the people of the State of California by the Attorney General. The civil penalties provided for in this section shall be exclusively assessed and recovered in a civil action brought in the name of the people of the State of California by the Attorney General. $7,500 per intentional violation, $2,500 per unintentional. [1] https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180SB1121 https://leginfo.legislature.ca.gov/faces/billTextClient.xhtm...

patja 9mo ago
But the California law only applies if your business has more than $25m revenue or does a lot of selling of PII. See SEC. 9. Section 1798.140 in the page linked.
- petcat 9mo ago
  > [receives] the personal information of 50,000 or more consumers, households, or devices. That's a trivially small bar to clear in order to be regulated under the CCPA where large-scale data harvesting is the focus.
  - patja 9mo ago
    There is more to that clause: Alone or in combination, annually buys, receives for the business’s commercial purposes, sells, or shares for commercial purposes, alone or in combination, the personal information of 50,000 or more consumers, households, or devices. So it only applies if you are buying or selling or sharing PII. Not if you just have 50,000 users/visitors to your website and keep it all private.

by petcat 9mo ago

patja 9mo ago

But the California law only applies if your business has more than $25m revenue or does a lot of selling of PII. See SEC. 9. Section 1798.140 in the page linked.

petcat 9mo ago
> [receives] the personal information of 50,000 or more consumers, households, or devices. That's a trivially small bar to clear in order to be regulated under the CCPA where large-scale data harvesting is the focus.
- patja 9mo ago
  There is more to that clause: Alone or in combination, annually buys, receives for the business’s commercial purposes, sells, or shares for commercial purposes, alone or in combination, the personal information of 50,000 or more consumers, households, or devices. So it only applies if you are buying or selling or sharing PII. Not if you just have 50,000 users/visitors to your website and keep it all private.