The California Consumer Privacy Act governs three different types of data usages: collection of data, disclosure of data, and sale of data. It is important for businesses, including auto dealers, to know not only what type of data they are collecting, but what use they intend to put it to, as their duties under the law depend on the data usage.

Data collection is the broadest category and has the fewest rules. Collection includes:

“[B]uying, renting, gathering, obtaining, receiving, or accessing any personal information pertaining to a consumer by any means. This includes receiving information from the consumer, either actively or passively, or by observing the consumer’s behavior.”[1]

Practically, this covers essentially all of the data dealerships have regarding customers, whether received directly from the customer, from making notes about the customer, or collecting from a third source. Therefore, even if customer data never leaves your dealership (which is highly unlikely) you must be concerned regarding the requirements that apply to data collection.

The next broadest data usage category is disclosure. While the term is not defined, based on its usage in the statute it appears to apply to information that is disclosed to a third-party other than the business in question. Further, as used it applies to data disclosed for a “business purpose,” defined as an operational purpose. Data disclosure is distinguished from “selling” data, so the category may best be thought of as data usage that benefits or supports the dealership’s business operations, as opposed to the business of another.

Data sales is the smallest category, but also the most restricted. It is defined as “selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating … a consumer’s personal information by the business to another business or a third party for monetary or other valuable consideration.” Dealerships should pay special attention to the fact that the definition includes disclosure for valuable consideration, as this may be interpreted to include data disclosed to manufacturers or lenders as part of the business relationship, if not done for the dealership’s business purpose.

---

[1] 1798.140(e).