Written with Joel Sherwin. Joel Sherwin is a business lawyer who regularly advises financial technology, payments, and e-commerce companies on commercial transactions and regulatory requirements, including consumer privacy, BSA/AML and KYC compliance.

The California Consumer Privacy Act, or CCPA, took effect January 1, 2020. After spending some time with it, the first thing that becomes apparent is how broad the law is. It’s probably broader than most businesses realize. We’re starting a series that will cover some of the challenges when trying to navigate CCPA compliance especially how this might impact tournament organizers and publishers in esports.

This series will break down:

1. Which businesses fall under CCPA?
2. What does it mean to comply with CCPA?
3. What is the risk of esports tournament organizers and publishers under CCPA?

This first installment will give a basic overview of CCPA and outline who is affected by the new legislation. The first point I think is going to give people some trouble is whether or not any of this actually applies to their business. There are three criteria that people should pay attention to and a business only has to meet one of them to fall under the umbrella of the CCPA:

• The business has to have $25 million USD or more in annual revenue
• Buys, sells, or receives or shares the personal data of more than 50,000 consumers, households, or devices
• Earn more than half of its annual revenue selling consumers’ personal data

Smaller companies with less than $25 million in annual revenue or those that don’t “sell” consumer data, may think that the CCPA doesn’t apply to them. However, that may not be the case because what it means to “receive” personal information (PI) of at least 50,000 California residents means. It requires digging into the definition of PI.

In actuality, what we find is that the definition of personal information, whether it’s intended to or not, covers things like IP addresses. This means that once a site hits 50,000 annual unique visitors from California to a website, that can trigger the threshold due to the broad definition of PI. Publishers and esports tournament organizers can easily exceed the threshold based on web traffic alone. Another thing to consider is that many of the views or people who interact with their site will not be from California, so they will need to review their analytics to determine how much web traffic is coming from California.

It’s also important to note that the definition of “sale” with regard to selling data is very broad. It’s not necessarily as simple as someone offering money in exchange for user data. The definition doesn’t require an exchange of money, but rather a disclosure of personal information for something of value that’s received or returned. It has to do with relationships that are based on some sort of value because of the sharing of data.

One example of this kind of exchange would be companies who reward consumers for referrals, or even a tournament organizer hosting tournament sign ups on a third party site. Both of these instances could constitute a sale, even if no money changed hands.

Many game publishers and esports tournament organizers may not realize that they fall under the umbrella of CCPA, especially when it comes to the stipulations regarding the sale of data. Many companies within the esports space may meet the CCPA requirements based on web traffic alone, without taking into account that they may be “selling” data without realizing it, since often times, these exchanges do not require monetary compensation. It’s important for publishers and tournament organizers to be aware of where their web traffic is coming from and to examine how they handle data and the sharing of data in order to determine what their next steps are when complying with CCPA.

The materials available at this web site are for informational purposes only and not for the purpose of providing legal advice. You should contact your attorney to obtain advice with respect to any particular issue or problem.

Need Help Navigating CCPA?

Reach out and talk to us about how to navigate CCPA and Paying Prize Money