What you need to know about the California Association of Realtors’ CCPA Advisory Form

If you are a realtor in California and have received or provided your clients with the California Association of Realtors’ California Consumer Privacy Act (CCPA) Advisory Form, you may be wondering what this form means and whether it requires you, as the realtor, to comply with the CCPA. The CCPA is a privacy law that was passed in 2018 that requires certain businesses to have a comprehensive Privacy Policy and provides privacy rights to residents of California. The main purpose of the CCPA Advisory Form is to advise consumers that they may have certain privacy rights if the business that they are giving their personal information to in the course of buying or selling real estate has to comply with this privacy law. In this article, we will discuss what the CCPA Advisory Form states, and the obligations of realtors when it comes to compliance with California’s privacy laws.

Obligations placed upon realtors by the CCPA Advisory Form

At its core, the CCPA Advisory Form is an informational document and thus does not place any additional privacy obligations upon realtors. The CCPA Advisory Form informs individuals that they may have certain privacy rights under the CCPA such as the right to request the deletion of their personal information in certain cases. The form also explains that personal information may be shared with third parties in the course of a real estate transaction. Lastly, the form explains that not all businesses need to comply with the CCPA, but those that do will need to provide consumers with a comprehensive Privacy Policy and privacy rights. Thus, the form does not, by itself, oblige real estate agents to comply with the CCPA, but instead, informs consumers of their rights if their agent needs to comply with the CCPA by statute.

Do real estate agents need to comply with the CCPA?

Real estate agents need to comply with the CCPA if they do business in California, collect the personal information of California residents and meet one of the following criteria:

  • Have annual gross revenue of $25,000,000 or more;
  • Buy, receive, sell or share the personal information of 50,000 or more California consumers, households or devices; or
  • Derive at least 50% of its annual revenue from selling the personal information of California residents.

It is also important to note that if you meet the above criteria but are not physically located in California, the CCPA will still apply to you. If you do need to comply with the CCPA, you are required to have a comprehensive Privacy Policy on your website that makes the disclosures required by this law.

Real estate agent CCPA compliance requirements

Real estate agents that need to comply with the CCPA should be aware that the costs of non-compliance are high – from $2,500 to $7,500 per website visitor whose privacy rights have been infringed upon. The first step to CCPA compliance is to have a Privacy Policy on your website that makes all of the following disclosures:

  • Your name and contact details;
  • What personal information you collect;
  • Sources from which you collect the personal information;
  • Purposes for which you will use the personal information;
  • Whether you share personal information with any third parties. If you do share personal information, your Privacy Policy will need to disclose the categories of third parties with whom you share the personal information;
  • Whether you sell personal information. If you do sell personal information, your Privacy Policy will need to include a link to a page where consumers can opt out of such sales (also called a “Do Not Sell My Personal Information” page). If you sell large amounts of personal information, your Privacy Policy will need to disclose additional information, such as how many requests to opt out of sales you have received in the last 12 months;
  • Whether you offer consumers a financial incentive or a service or price difference if they do not exercise their privacy rights;
  • A list of the privacy rights provided to consumers;
  • How consumers can exercise their privacy rights, including:
    • How a consumer can submit a request to exercise their rights;
    • What personal information a consumer will need to provide to verify their identity to exercise their rights; and
    • What information needs to be submitted for a consumer to designate an agent that can exercise privacy rights on the consumer’s behalf;
  • Where a consumer can contact you for questions regarding your Privacy Policy and privacy practices.

Real estate agents that need to comply with the CCPA must also keep their Privacy Policy up to date with any new regulations issued by the California Attorney General’s office and any amendments to the law such as the California Privacy Rights Act, which will go into effect on January 1, 2023.

In addition to having a comprehensive and up to date Privacy Policy, real estate agents that need to comply with the CCPA will also need to effectuate the privacy rights provided to consumers. The CCPA provides the following privacy rights:

  • The right to notice – this right means that businesses must provide consumers with the appropriate disclosures in Privacy Policies (see above);
  • The right to ask for the deletion of their personal information;
  • The right to access the personal information that a business holds about a consumers;
  • The right to opt out of the sale of personal information; and
  • The right to non-discrimination based upon the exercising of privacy rights.

It is important to note that realtors that do not need to comply with the CCPA may still need to comply with California’s other privacy law, the California Online Privacy and Protection Act of 2003 (CalOPPA), which also requires businesses to have a comprehensive Privacy Policy.

Do real estate agents needs to comply with CalOPPA?

Even though the CCPA Advisory Form does not mention it, CalOPPA is another California privacy law that may apply to real estate agents. CalOPPA applies to operators of commercial websites (regardless of location) that collect the personal information of California residents. Real estate agents that have forms on their website such as contact or inquiry forms, email newsletter sign up forms, or account creation forms, could be collecting the personal information (such as names, emails, or phone numbers) of California residents and thus may need to comply with this law.

Real estate agent CalOPPA compliance requirements

CalOPPA can also impose heavy fines for non-compliance, starting at $2,500 per website visitor whose privacy rights were infringed upon. CalOPPA requires certain websites to have a comprehensive Privacy Policy that makes the following disclosures:

  • Effective or last updated date of the Privacy Policy;
  • Your name and contact details;
  • What personal information you collect;
  • Whether you share personal information with any third parties. If you do share personal information, your Privacy Policy will also need to include the categories of third parties that you share personal information with;
  • How your website responds to Do Not Track signals;
  • How you will notify users of changes to your Privacy Policy; and
  • Whether your website uses cookies and other tracking technologies.

It is also important to note that CalOPPA can apply to real estate agents that are located outside of California if their website collects the personal information of California residents.

Other privacy laws that can apply to real estate agents

Real estate agents should be aware that there are other privacy laws that can apply to them, even if they are not located in the country or state in which those laws are passed. For example, Nevada Revised Statutes Chapter 603A can apply to any website owner that collects the personal information of Nevada residents and that purposefully directs its activities towards Nevada, consummates a transaction with the State of Nevada or a resident of Nevada, purposefully avails itself of the privilege of conducting activities in Nevada or otherwise engages in any activity that constitutes sufficient nexus with Nevada to satisfy the requirements of the US Constitution. In addition, the Delaware Online Privacy and Protection Act (DOPPA), applies to any website that collects the personal information of Nevada consumers. And, the General Data Protection Regulation (GDPR) applies to anyone offering goods or services to residents of the European Union or monitoring the behavior of European Union residents, regardless of their location. Since real estate agents often collect the personal information from individuals residing in other states or countries that are looking to buy or sell real estate, real estate agents should review this list of the laws that require websites to have a Privacy Policy to determine what privacy laws apply to them.

Real estate agents should know that the CCPA Advisory Form does not, by itself, require them to comply with the CCPA. However, if you do meet the criteria listed above, it is important to be compliant with California’s privacy laws by providing a comprehensive and up to date Privacy Policy that contains all of the required disclosures. If you do not currently have a Privacy Policy, make sure to check out Termageddon’s Privacy Policy generator. The first page of the Privacy Policy questionnaire will help determine what privacy laws apply to you, including CCPA and CalOPPA. If you need to comply with these laws, your Privacy Policy will then be generated to include all of the required disclosures listed above.