With COVID-19 driving so much business online, like most people, I am increasingly seeing offers from companies vying for new customers to hand over my contact information in exchange for discounts or rewards. This includes businesses that seek to use personal information obtained through loyalty or rewards programs, those that offer price or service differences such as with free versus paid subscriptions to a service (e.g., music streaming), or those that simply want to increase their marketing reach and attract new consumers by offering a discount in exchange for personal information. There is really nothing new to these types of marketing strategies, but for companies that are subject to the California Consumer Privacy Act (CCPA), providing discounts, rewards or free-versus-paid services to California consumers has become trickier because the CCPA contains very specific – and quite stringent – obligations when it comes to financial incentives. The CCPA defines a “financial incentive” as a program, benefit, or other offering (including payments to consumers) related to the collection, retention, or sale of personal information – or, put simply, you give me your personal information and I will give you a discount code or rewards. Many businesses that are subject to CCPA, however, are not complying with the CCPA’s complex requirements regarding financial incentives. Failing to comply could spell trouble. Below we explain the challenges of implementing the CCPA’s requirements with respect to financial incentives.
What’s the Data Worth? Balancing Non-Discrimination and Financial Incentives
By way of background, in addition to regulating financial incentives, the CCPA prohibits discriminatory practices where consumers exercise their rights, meaning that a covered business may not treat a consumer differently because the consumer has exercised his or her rights under the CCPA. For instance, if a consumer exercises a right, such as by unsubscribing from marketing communications or submitting a request to opt-out from the sale of personal information, the business may not charge a different price or rate, or provide a different level of goods or services, that go beyond the value of the information that would have been collected had the consumer not exercised his or her rights. If your covered business offers financial incentives, complying with CCPA therefore requires a difficult balancing act of providing these financial incentives while also not discriminating against consumers. Unfortunately, the language of section 1798.125, which addresses discrimination and the use of financial incentives, is not exactly drafted in the most helpful way:
- At the outset, a business may not discriminate against a consumer where the consumer exercises his or her rights under the CCPA by (a) denying goods or services to the consumer, (b) charging different prices or rates (including through the use of discounts or other benefits or imposing penalties), (c) providing a different level or quality of goods or services, or (d) suggesting that a consumer will receive a different price or rate for goods or services or a different level of quality.
- That said, nothing prohibits a business from charging a consumer a different price or rate, or from providing a different level or quality of goods or services to the consumer, if that difference is reasonably related to the value provided to the business by the consumer’s data. As such, a business may offer financial incentives, including payments, for the collection, sale, or deletion of personal information.
Thus, the value of consumer data becomes the crux of the analysis, although in reality the practical complexities of assessing the value of consumer data are quite significant. The CCPA’s implementing regulations (Regulations) make clear that if a business is unable to calculate a good-faith estimate of the value of the consumer’s data or cannot show that the financial incentive or price or service difference is reasonably related to the value of the consumer’s data, it simply must not offer the financial incentive or price or service difference. So how does one calculate the value of consumer data? Here again, the Regulations attempt to provide some clarity and include a list of considerations and factors to assist in determining value – none of which are especially helpful in practice. You can find that list in the very last section (s. 999.337) of the Regulations, as well as a few examples on how to balance financial incentives and non-discrimination (s. 999.336).
Note also that each program or price or service difference must be assessed separately. In addition, this analysis becomes even more complex where a business’ offered incentives are actually provided by another service in exchange for personal information, which is often the case with gaming or streaming services that rely both on credits and monetization.
Notice and Opt-In
Once a covered business has made a preliminary assessment of each financial incentive and the value thereof, it must provide a just-in-time notice to consumers that explains the material terms of the incentive or price or service difference so that they can make an informed decision about whether to participate. As set forth in the Regulations (s. 999.307), the notice of financial incentive must:
- Use plain, straightforward language and avoid technical or legal jargon;
- Use a format that draws the consumer’s attention to the notice and makes the notice readable;
- Be available in the languages in which the business in its ordinary course provides contracts, disclaimers, sale announcements, and other information to consumers in California;
- Be reasonably accessible to consumers with disabilities, as per generally recognized industry standards (as is the case with all notices under CCPA); and
- Be readily available where consumers will encounter it before opting-in to the financial incentive or price or service difference.
If the business offers the financial incentive or price or service difference online, the notice may be given by providing a link to the section of a business’s privacy policy that contains the following information:
- A succinct summary of the financial incentive or price or service difference offered;
- A description of the material terms of the financial incentive or price or service difference, including the categories of personal information that are implicated by the financial incentive or price or service difference and the value of the consumer’s data;
- How the consumer can opt-in to the financial incentive or price or service difference;
- A statement of the consumer’s right to withdraw from the financial incentive at any time and how the consumer may exercise that right to opt-out; and
- An explanation of how the financial incentive or price or service difference is reasonably related to the value of the consumer’s data, including (a) good-faith estimate of the value of the consumer’s data that forms the basis for offering the financial incentive or price or service difference and (b) a description of the method the business used to calculate the value of the consumer’s data.
Importantly, where a business covered under CCPA offers financial incentives or differences in service or goods in connection with the collection or sale of a consumer’s data, it must allow consumers to opt-in to the incentive – regardless of the age of the consumer. Agreeing to the privacy policy and terms of use does not constitute a proper opt-in. In addition and as noted above, that opt-in should be also accompanied by a statement that a consumer may withdraw from the financial incentive at any time, and how he or she may go about doing so.
Finally, the right not to be discriminated against should also be prominently laid out in the privacy or CCPA notice for consumers. And for businesses that work with third-party partners to offer financial incentives (as is often the case such as in exchange for credits or rewards), the business and the partner should contractually agree in advance on which party will be responsible for providing the notice and ensuring that no discrimination results from a consumer exercising his or her rights.
Recap
Businesses subject to CCPA and offering financial incentives must (1) determine the value of consumer data for each financial incentive, (2) provide proper notice and opt-in and (3) take care not to discriminate against consumers who exercise their rights. Though it has received less attention than the highly debated “sale” component of CCPA, this requirement also requires an in-depth analysis of data collection and use. In practice, some companies have properly applied these rules, but the majority have not. What’s more, many of the companies that do provide proper notices and opt-in mechanisms have (understandably) done a poor job of clearly explaining exactly how the financial incentive or price or service difference is reasonably related to the value of the consumer’s data. Though not specifically stated as being at the top of the California AG’s list of CCPA enforcement priorities, the financial incentives requirements are closely tied to consumer rights and in particular the right to opt-out of sales, which, on the other hand, has definitely been mentioned as a top priority.