CCPA Information

Note – This is an attempt to describe the California Consumer Privacy Act (“CCPA”) in a very simple way and is not, nor is it intended to be taken as, legal advice. Please seek the advice of legal counsel if you want to learn more about how the CCPA might impact your business.

If you have received an email that says, “Powered by ActiveCampaign,” and you are not an ActiveCampaign customer, but wish to exercise your California Privacy Rights, please contact the business who sent you the email for instructions. As a service provider under the CCPA, ActiveCampaign is obligated by law to handle personal information only upon the instructions and with the authorization of ActiveCampaign customer(s). If you are unsure of the ActiveCampaign customer to contact in order to exercise your California Privacy Rights, please look at the name of the business and/or email address from which the communication originated.

If you are a California resident, and an ActiveCampaign customer or ActiveCampaign has previously communicated with you about becoming an ActiveCampaign customer, and you wish to exercise your rights under the CCPA, please see the information below.  

What is the CCPA?

The California Consumer Privacy Act or the “CCPA” is a California law that is designed to allow for greater privacy controls and transparency in data practices in response to the increased role of technology and data practices in consumers’ lives. The law applies to the personal information of California residents.

When did the CCPA take effect?

The CCPA went into effect January 1, 2020.

What is the CPRA?

The California Privacy Rights Act or the “CPRA” is a California law that amends and expands the privacy protections available to California residents in the CCPA.

The CPRA will become effective on January 1, 2023. 

Note: In this article, the “CCPA” refers to the California Consumer Privacy Act, as amended by the CPRA.

Who does the CCPA apply to and what does it cover?

The CCPA applies to “businesses” that collect “personal information” of California residents and that meet any of the following three thresholds:

• Have a gross annual revenue that exceeds $25 million in the prior calendar year
• Buy, receive, sell or share personal information of 100,000 or more consumers or households
• Derives 50% or more of its annual revenue from selling or sharing personal information

Notably, a business does not have to be physically located in California for the CCPA to apply. The law applies broadly and protects California residents (“consumers”), even if the business is located outside of California. “Personal information” is also very broadly defined and includes “information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer.”

What changes happened with the CCPA  and the CPRA?

Note: This section summarizes some of the notable provisions of the CCPA  and the CPRA, but it is not intended to be exhaustive or constitute legal advice.

The CCPA imposes a range of additional requirements on businesses, including various notice obligations, many of which can be addressed in a business’ privacy policy. The law also provides California residents with several rights with respect to their personal information—including the right to know the categories of personal information collected about them in the past year, the right to access specific pieces of their personal information that was collected in the last year, the right to opt out of the “sale” of their personal information and the right to request deletion of their personal information.

In addition, with the CPRA taking effect, California residents will have new rights starting in 2023, such as the right to correct inaccurate personal information, the right to opt out of the “sharing” of personal information for cross-context behavioral advertising purposes, and the right to restrict sensitive personal information processing.

A significant new obligation under the CCPA is the requirement to allow California residents to opt out of “sales” of personal information. Put simply, a “sale” of personal information involves a disclosure of personal information to a third party (who is not just a service provider to you) in return for money or some other form of value.

The CPRA expands the CCPA’s opt-out right to cover the “sharing” of personal information, which takes on a special meaning differing from the term’s common use and generally refers to a disclosure of personal information to a third party for cross-context behavioural advertising purposes.

Under the CCPA and the CPRA, businesses that “sell” or “share” personal information of California residents must post a link on their website that allows consumers to opt-out of the sale or sharing of their information (“Do Not Sell or Share My Personal Information”).

How does ActiveCampaign fit into all of this?

In the way ActiveCampaign provides the ActiveCampaign platform and its services to you, we act as what is called a “service provider” with respect to those of our customers who are considered “businesses” (as described above) under the CCPA. This means that you remain in control of your customers’ contact data and we only handle that data in order to provide our services to you or on your instructions and don’t otherwise use, disclose, sell, or share your customers’ personal information without checking with you (unless allowed or required by law).

For your CCPA and CPRA preparation, we updated our Data Processing Addendum (“DPA”). You can access and sign ActiveCampaign’s DPA by following the links within the settings of your ActiveCampaign account, and if you wish to review the terms of the DPA prior to execution, you can view the template here.

How to Exercise Your California Privacy Rights

PLEASE NOTE: ActiveCampaign offers an online platform by which its customers can send emails to their business contacts. This means that emails you received saying “Powered by ActiveCampaign” likely did not come from ActiveCampaign, but one of our customers.

If you are not an ActiveCampaign customer and wish to exercise your California Privacy Rights, you must contact the individual or business that sent you the email, NOT ActiveCampaign.

As a service provider, ActiveCampaign is obligated by law to handle personal information only upon the instructions and with the authorization of ActiveCampaign customer(s). If you are unsure of the ActiveCampaign customer to contact in connection with your California Privacy Rights, please look at the name of the business and/or email address from which the communication originated.

If you have a current ActiveCampaign account, are a resident of California, and wish to exercise your California Privacy Rights, you can do so by clicking “Do Not Sell or Share My Personal Information” below.

Do Not Sell or Share My Personal Information

If you are a former ActiveCampaign customer or if we have previously communicated with you about becoming an ActiveCampaign customer and you no longer wish to receive messages from us, please click the unsubscribe link in the email we sent you.

If you are a resident of California and either are a former ActiveCampaign customer or you have received email communications from us about becoming an ActiveCampaign customer and you wish to exercise your California Privacy Rights, you may submit a request by clicking here.