Over the last few months, consumers have been doing more online shopping, subscribing to more services, and using more gaming platforms. Like most people, we are seeing offers from many websites to receive 10% off or earn rewards if we provide them our email address or phone number. For companies that are subject to the CCPA, providing discounts, rewards or free-versus-paid services can be tricky because the CCPA contains very specific – and quite stringent – obligations when it comes to financial incentives. The CCPA defines a “financial incentive” as a program, benefit, or other offering, including payments to consumers, related to the collection, retention, or sale of personal information.
From what we have seen, many businesses that are very likely subject to CCPA are not complying with the CCPA’s complex requirements. In many cases, it’s possible that this lack of compliance may be directly related to the difficult balancing act of providing financial incentives while also not discriminating against consumers, which is only rendered more difficult by the ambiguous language of the CCPA. Indeed, Section 1798.125 is riddled with “do’s”, “don’t(s)” and “well it depends”:
- At the outset, a business may not discriminate against a consumer where the consumer exercises his or her rights under the CCPA by (a) denying goods or services to the consumer (b) charging different prices or rates (including through the use of discounts or other benefits or imposing penalties) (c) providing a different level or quality of goods or services, or (d) suggesting that a consumer will receive a different price or rate for goods or services or a different level of quality.
- Nothing prohibits a business from charging a consumer a different price or rate, or from providing a different level or quality of goods or services to the consumer, if that difference is reasonably related to the value provided to the business by the consumer’s data.
- A business may offer financial incentives, including payments, for the collection, sale, or deletion of personal information.
Thrown into this mix, of course, is the crucial yet difficult task of determining the value of a consumer’s personal data (more on that below). Importantly, where a business covered under CCPA offers financial incentives or differences in service or goods in connection with the collection or sale of a consumer’s data, it must allow consumers to opt-in. It must also provide the consumer notice of the financial incentive program’s material terms and a clear explanation on how to opt-out. As such, figuring out whether a discount or reward or loyalty program qualifies as a financial incentive is important because such programs require both updating notices and implementing an opt-in (and opt-out).
In an attempt to provide more clarity, the second draft of the proposed regulations (still to be finalized) state that “[a] business may offer a financial incentive or price or service difference if it is reasonably related to the value of the consumer’s data. If a business is unable to calculate a good-faith estimate of the value of the consumer’s data or cannot show that the financial incentive or price or service difference is reasonably related to the value of the consumer’s data, that business shall not offer the financial incentive or price or service difference.” Thus, the value of the consumer’s data becomes the crux of the analysis, although in reality the practical complexities of assessing value are quite significant. Here again, the proposed regulations have attempted to provide additional guidance on the means by which value is calculated, and include a list of considerations and factors to assist in determining value. Each program or price or service difference must be assessed separately. This analysis becomes all the more complex where one platform’s credits are provided by another service in exchange for personal information, which is often the case with gaming or streaming services that rely both on credits and monetization.
The proposed regulations also provide a number of examples, some of which are somewhat helpful. Two stand out in the context of online discounts offered in exchange for personal information:
- A clothing business offers a loyalty program whereby customers receive a $5-off coupon to their email address after spending $100 with the business. A consumer submits a request to delete all personal information the business has collected about them but also informs the business that they want to continue to participate in the loyalty program. The business may deny their request to delete as to their email address and the amount the consumer has spent with the business because that information is necessary for the business to provide the loyalty program requested by the consumer and is reasonably anticipated within the context of the business’s ongoing relationship with them pursuant to Civil Code Section 1798.105, subdivision (d)(1). (3).
- A grocery store offers a loyalty program whereby consumers receive coupons and special discounts when they provide their phone numbers. A consumer submits a request to opt-out of the sale of their personal information. The retailer complies with their request but no longer allows the consumer to participate in the loyalty program. This practice is discriminatory unless the grocery store can demonstrate that the value of the coupons and special discounts are reasonably related to the value of the consumer’s data to the business.
What does this mean for businesses subject to CCPA?
With respect to businesses that seek to use personal information obtained through loyalty or rewards programs, those that offer price or service differences such as with free and paid subscriptions to a service (e.g., music streaming), or those that simply want to increase their marketing reach by attracting new consumers by offering a discount in exchange for their personal information, first determining which programs offer “financial incentives” and then implementing a process to properly address consumer rights in this context will be key to complying with this important part of the CCPA. Failing to recognize that a financial incentive is offered may result in fines once the California Attorney General begins enforcement on July 1, 2020.