If you don’t follow CalOppa’s detailed requirements, the state can fine you up to $2,500 per violation, although you will first receive a 30-day notice to comply.
The only other states that currently have similar laws are Nevada and Delaware. Texas will have a similar law go into effect on Jan. 1, but it will exempt businesses classified as small under Small Business Administration rules, which, in the case of travel agencies, means those with less than $25 million in revenue (i.e., commissions, overrides, fees and markups). That standard exempts almost all agencies.
You may read that Virginia, Colorado, Connecticut and Montana have similar laws, but they apply only to companies that specifically target residents of those states and collect the personal data of at least 100,000 residents of the state per year (50,000 in Montana) or derive 50% of gross revenue from the sale of personal data.
Several more states have laws that will apply if you collect more than 100,000 residents’ data and that will go into effect in the future: Utah on Jan. 1; Oregon on July 1; Iowa on Jan. 1, 2025; Tennessee on July 1, 2025; and Indiana on Jan. 1, 2026.
Source: Read Full Article