- 1798.100 – Consumers right to receive information on privacy practices and access information
- 1798.105 – Consumers right to deletion
- 1798.110 – Information required to be provided as part of an access request
- 1798.115 – Consumers right to receive information about onward disclosures
- 1798.120 – Consumer right to prohibit the sale of their information
- 1798.125 – Price discrimination based upon the exercise of the opt-out right
Under the CCPA, can a conference organizer use on-site tracking at their conference for first-party marketing?
Yes.
On-site tracking refers to the practice of scanning attendees’ badges manually (e.g., bar code) or automatically (e.g., RFID chip in badges read at doorways). Organizers track this information for various reasons, such as to award credit for attending various panels (e.g., continuing education verification) or for their own analytics (e.g., to track session attendance for future room allocation or to determine future programming).
Assuming that the CCPA applies to a conference organizer (e.g., the organizer does business in California and meets the minimum revenue or data subject thresholds), nothing within the CCPA prohibits the organizer from collecting on-site tracking data, or using that data for first party marketing (e.g., to market additional conferences to attendees, or services at a conference being attended). The CCPA would require that a conference organizer disclose that they are tracking attendee behavior as well as disclose their purpose for tracking – including the use of the data for marketing purposes. While the disclosure might come in the form of a privacy policy provided to attendees, it could be less formal – such as via a poster or sign at check-in. Conference organizers should also consider the additional CCPA related implications:
- If the organizer intends to sell the data to third parties, the organizer will need to provide a “Do Not Sell my Information” link in their online privacy notice.
- An organizer may receive a request from an attendee for access to their information. In response to such a request, they may need to disclose all of the data collected about a particular attendee (e.g., locations tracked, activities recorded).
- An organizer may receive a request from an attendee to delete their information. In response to such a request, they may need to have the ability to selectively delete information about the attendee, or to explain to the attendee why such information is not required to be deleted. For example, if the information is being collected for a purpose other than marketing – such as security at the conference – the organizer may be able to deny the request on those grounds.
If the organizer relies upon a third party to collect, host, analyze, or manage the data collected about attendees, the contract with the third party should meet the “service provider” requirements of the CCPA.
Co-authored by Jason Schultz