Law / United States / 
California
California Consumer Privacy Act, deidentified information
CCPA, Cal. Civ. Code section 1798.140(m)
In force since .
A de-identification rule binding private bodies.
- Obligation class
- Disclosure, Prohibition
- Audit expectation
- none
What it requires
- To treat information as deidentified under the CCPA, take reasonable measures to ensure that it cannot be associated with a consumer or household (Civ. Code section 1798.140(m)(1)).
- Publicly commit to maintain and use the information in deidentified form and not to attempt to reidentify it, except that you may attempt to reidentify it solely to determine whether your deidentification processes meet the definition (Civ. Code section 1798.140(m)(2)).
- Contractually obligate every recipient of the information to comply with all provisions of the definition (Civ. Code section 1798.140(m)(3)).
These lines are LexLint's reading of the law's text.
What it makes you log
Logging duty
Section 1798.140(m) states the conditions for treating information as deidentified. It states no log or record duty.
- Kind
- None
- As of
What this law does
Section 1798.140(m) defines deidentified information as information that cannot reasonably be used to infer information about, or otherwise be linked to, a particular consumer, provided that the business that possesses the information meets three conditions. Under section 1798.140(m)(1), the business that possesses deidentified information must take reasonable measures to ensure that the information cannot be associated with a consumer or household.
Under section 1798.140(m)(2), that business must publicly commit to maintain and use the information in deidentified form and not to attempt to reidentify it, except that the business may attempt to reidentify the information solely for the purpose of determining whether its deidentification processes satisfy the requirements of the subdivision.
Under section 1798.140(m)(3), that business must contractually obligate any recipients of the information to comply with all provisions of the subdivision. The definition of personal information in section 1798.140(v)(3) does not include consumer information that is deidentified or aggregate consumer information.
Section 1798.145(a)(1)(F) provides that the obligations the Act imposes on businesses do not restrict a business’s ability to collect, use, retain, sell, share, or disclose consumers’ personal information that is deidentified or aggregate consumer information.
When LexLint raises it
When your app profile says your app processes personal data or processes de-identified data.
Back to the example · Lint your app
Page updated .