Do I Need a Toll-Free Number for CCPA?

The CCPA Toll Free Number Requirement Explained

Updated as of September 2020 based on the California Attorney General’s final CCPA regulations.

When California’s Governor signed the CCPA into law, it required all businesses to provide consumers with two or more methods for submitting privacy requests, including a toll-free telephone number. In October of 2019, the Governor signed amendment AB-1564 to the CCPA that provides relief from the toll-free number requirement for businesses that (1) operate exclusively online and (2) have a direct relationship with the consumers from whom they collect personal information. Businesses meeting these criteria can provide an email address in lieu of a toll-free number.

On a first reading, amendment AB-1564 appears relevant for many businesses. However, the reality of AB-1564 is that almost all businesses continue to require the toll-free number because either (1) or (2) is not true for them. Let’s review these two criteria in turn:

  1. Do you operate exclusively online? It is obvious that if you operate a brick-and-mortar retail store, a bank branch, a car dealership or a real estate office, that you do not operate exclusively online. But what if you’re an “online only business” that attends trade shows, hosts events, exchanges business cards or engages in guerrilla marketing such as handing out product samples and posting photos of the giveaway on social media? In each of these circumstances, you are collecting someone’s name, email or image, all of which are all personal information under the CCPA. Hence, your business probably isn’t online only for CCPA purposes.
  2. Do you have a direct relationship with each of your consumers? If you’re strictly an offline retailer, the answer may be an obvious yes. Consumers walk into your store and transact with you directly. If you have an online component to your business, you may still have a direct relationship with your consumers. If you’re an online news publisher or an e-commerce storefront, consumers may browse your company owned and operated online properties to read your content or buy your merchandise. So far, that’s direct.

    However, what if you also reach consumers with whom you have no direct relationship, for example by advertising online? In a typical online marketing campaign, you advertise your goods, services or content on third party websites and you collect marketing analytics data about the consumers exposed to those ad impressions. For example, if  a consumer browses and sees your ad, you may collect via your ad tech platforms a cookie ID, IP address or other unique identifier, all of which are personal information under the CCPA. In this example, it is the New York Times as the publisher and not you who has the direct consumer relationship. The same logic applies when you buy or exchange email marketing lists with third parties. Since an email address is personal information, you have an indirect relationship with those consumers. Accordingly, most businesses conclude that they have gathered some consumer information indirectly.

The scenarios described in (1) and (2) above demonstrate the need for privacy professionals to form nuanced judgments about whether everyday activities render a company eligible to qualify for AB-1564’s toll-free number exemption. For companies that use modern sales and marketing techniques, it is very difficult to avoid the toll-free number requirement. Given the ease of complying by using a solution like, it makes sense for companies to follow best practices and provide their consumers with a toll free privacy hotline.

CCPA Toll Free’s solution starts at $29 per month and features:

  • free trial including access to a toll-free number provisioned instantly
  • No long-term commitments, and cost savings for annual plans
  • Enterprise readiness with encryption and two-factor authentication
  • Access to the shared 866-I-OPT-OUT privacy hotline or a dedicated toll-free number
  • Telephone voice prompts that work by default and are customizable for your brand
  • An interactive web form privacy request manager to embed in your privacy policy
  • A solution for Do Not Sell My Personal Information homepage links
  • A secure dashboard to check telephone and web form requests, including tools to demonstrate your compliance
  • Emails when you receive a request or a deadline is approaching–no remembering to log into the dashboard

For questions about the CCPA Toll Free solution, email or click here to watch our videos.