CCPA Quick Update: Certain Companies Must Report Consumer Request Metrics by July 1, 2021

If your business is subject to the CCPA and (alone or in combination) bought, received, sold, or shared for commercial purposes the personal information of 10 million or more consumers (i.e., California residents) in 2020, Section 999.317 of the CCPA Regulations requires you to report metrics regarding consumer requests annually beginning July 1, 2021. These metrics, to be provided in your privacy policy or on your business’s website, must be updated by July 1 of each year.

These metrics must include:

• The number of requests to know that the business received, complied with in whole or in part, and denied;
• The number of requests to delete that the business received, complied with in whole or in part, and denied;
• The number of requests to opt-out that the business received, complied with in whole or in part, and denied; and
• The median or mean number of days within which the business substantively responded to requests to know, requests to delete, and requests to opt-out.

Businesses may choose to compile and disclose metrics for all individuals, instead of just California consumers, but this choice must be clearly identified in the disclosure. The metrics for only California consumers must also be available for disclosure to the California Attorney General upon request.