Skip to content

Are you ready for HIPAA 2.0? Find out…

Close
  • Products
    • Products

      • Governance Suite Use Spirion’s suite to enhance data security posture management
      • Sensitive Data Platform Scan, classify, remediate using SaaS solution
      • Sensitive Data Finder Automate Subject Rights Request processing
      • Sensitive Data Watcher Actively monitor and understand your data
      • Sensitive Data Manager Scan, classify, remediate using on-premise solution
    • Learn more

      • Data Security Posture Management Identify security and privacy risks wherever data lives and secure where it travels.
      • Data Risk Assessment Proactive audit – discover how your org protects its sensitive data before a data breach occurs
      • Data Impact Assessment Reactive audit – respond to an incident for swift and accurate data breach mitigation
      • Privacy-Grade™ Compliance and privacy standards that set the bar for sensitive data protection.
    • Technology

      • CADIA Advanced ML/AI to accurately discover and classify sensitive data
      • AnyFinds™ Minimize false positives and deliver accurate matches
      • Interrogated Platforms More data sources than anyone including both unstructured and structured data
      • Marketplace Integrate with security tools and explore resources to boost data protection
      • Governance Framework Outlines key stages of readiness to safeguard sensitive data and maintain compliance.
    • WHITE PAPER

      Complete Your Microsoft 365 Data Protection Stack
  • Solutions
    • Industry Solutions

      • eCommerce
      • Finance
      • Healthcare
      • Higher Education
      • Manufacturing
      • Telecommunications
    • Security & Privacy Use Cases

      • Data Security Posture Management (DSPM)
      • Microsoft Purview Integration
      • DISCOVER: Sensitive data-at-rest is data-at-risk
      • CLASSIFY: Unify data governance efforts with context-rich classification
      • CONTROL: Reduce the risk and cost of a data breach
      • COMPLY: Accelerate PCI-DSS compliance
    • Compliance

      • Overview
      • GDPR
      • CCPA
      • CMMC
      • CPRA
      • GLBA
      • HIPAA
      • The New York SHIELD Act
      • PCI DSS
      • Other
    • WHITE PAPER

      Complete Your Microsoft 365 Data Protection Stack
  • Resources
    • Resources

      • Blog
      • Case Studies
      • Data Sheet
      • Events
      • MS Purview Calculator
      • Podcast
      • Whitepapers & Research
    • Core Expertise

      • How to take a data-centric approach to security
      • What are cyber insurance requirements?
      • What is data lifecycle management?
      • What is data loss prevention?
      • What is a data risk assessment?
      • What is endpoint security?
      • What is a sensitive data governance framework?
    • Core Capabilities

      • Data Discovery Software Tools: Capabilities and Benefits
      • What is sensitive data discovery?
      • What is semantic data discovery?
      • What is data classification?
      • What is data remediation?
    • WHITE PAPER

      Complete Your Microsoft 365 Data Protection Stack
  • Partners
  • Customers
    • Customers

    • Customer Services
    • Customer Portal
    • Premium Support
  • Company
    • Company

    • About Us
    • Careers
    • Leadership
    • News
    • Our History
  • Search
  • Contact
 Build your own demo
Build your own demo
  • Products
    • Governance Suite
    • Sensitive Data Platform
    • Sensitive Data Finder
    • Sensitive Data Watcher
    • Sensitive Data Manager
    • Learn more
      • Data Security Posture Management
      • Data Risk Assessment
      • Data Impact Assessment
      • Privacy-Grade™
    • Technology
      • CADIA
      • AnyFInds™
      • Interrogated Platforms
      • Marketplace
      • Governance Framework
  • Solutions
    • Industry Solutions
      • eCommerce
      • Finance
      • Healthcare
      • Higher Education
      • Manufacturing
      • Telecommunications
    • Security & Privacy Use Cases
      • Data Security Posture Management (DSPM)
      • Microsoft Purview Integration
      • DISCOVER: Sensitive data-at-rest is data-at-risk
      • CLASSIFY: Unify data governance efforts with context-rich classification
      • CONTROL: Reduce the risk and cost of a data breach
      • COMPLY: Accelerate PCI-DSS compliance
    • Compliance
      • Overview
      • GDPR
      • CCPA
      • CMMC
      • CPRA
      • GLBA
      • HIPPA
      • The New York SHIELD Act
      • PCI DSS
      • Other
  • Resources
    • Resources
      • Blog
      • Case Studies
      • Data Sheet
      • Events
      • MS Purview Calculator
      • Podcast
      • Whitepapers & Research
    • Core Expertise
      • How to take a data-centric approach to security
      • What are cyber insurance requirements?
      • What is data lifecycle management
      • What is data loss prevention?
      • What is a data risk assessment?
      • What is endpoint security?
      • What is a sensitive data governance framework?
    • Core Capabilities
      • Data Discovery Software Tools: Capabilities and Benefits
      • What is sensitive data discovery?
      • What is semantic data discovery?
      • What is data classification?
      • What is data remediation?
  • Partners
  • Customers
    • Customer Services
    • Customer Portal
    • Premium Support
  • Company
    • About Us
    • Careers
    • Leadership
    • News
    • Our History
  • Contact
Build your own demo
Hero Starlight Image
  • CCPA Summary and Key Issues

  • Consent
  • Enforcement
  • Financial Incentives
  • Jurisdictional Thresholds
  • Information Security
  • Marketing and Advertising
  • Notices to Consumers
  • Personal Information
  • Privacy Policy
  • Requests for Disclosure of Personal Information
  • Requests for Deletion
  • Service Providers
  • Sales of Minors’ Information
  • Sales to Third Parties
  • Verification of Requestors
View CCPA Act

Financial Incentives

The Statute

The CCPA section 1798.125 cites the concept of a “financial incentive” in the context of (and as a foil to) “discrimination” against consumers for exercising any of the consumer’s rights under the statute. Section 1798.125(a)(1) cites the following as examples of such discriminatory actions:

A. Denying goods or services to the consumer.
B. Charging different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties.
C. Providing a different level or quality of goods or services to the consumer.
D. Suggesting that the consumer will receive a different price or rate for goods or services or a different level or quality of goods or services.

However, this section qualifies the prospect of discrimination by stating that “[n]othing in this subdivision prohibits a business from charging a consumer a different price or rate, or from providing a different level or quality of goods or services to the consumer, if that difference is reasonably related to the value provided to the business by the consumer’s data.” 1

There are two types of financial incentives, direct payments and differences in price, rate, level, or quality of goods/services. The statute states that

[a] business may offer financial incentives, including payments to consumers as compensation, for the collection of personal information, the sale of personal information, or the deletion of personal information. A business may also offer a different price, rate, level, or quality of goods or services to the consumer if that price or difference is directly related to the value provided to the business by the consumer’s data. 2

Other requirements of the statute:

  • A business that offers any financial incentives pursuant to this subdivision shall notify consumers of the financial incentives pursuant to Section 1798.130 [i.e., consumer submission of requests for information]. 3
  • A business may enter a consumer into a financial incentive program only if the consumer gives the business prior opt-in consent pursuant to Section 1798.130 that clearly describes the material terms of the financial incentive program, and which may be revoked by the consumer at any time. 4

The statute does not delve into any detail on how to calculate the value of a consumer’s personal information; rather, it looks to the California Attorney General to promulgate the rules concerning this via the Regulations.

The Regulations

The CCPA Regulations define financial incentive as “a program, benefit, or other offering, including payments to consumers, related to as compensation, for the collection, retention disclosure, deletion, or sale of personal information.” 5 As with the statute, the Regulations use the prospect of discrimination against a consumer as a foil, stating that “[i]f a business is unable to calculate a good-faith estimate of the value of the consumer’s data or cannot show that the financial incentive or price or service difference is reasonably related to the value of the consumer’s data, that business shall not offer the financial incentive or price or service difference.” 6 This restriction is cited in Article 6 of the Regulations, the Article that addresses discriminatory practices.

With respect to the notice of the financial incentives, the Regulations explain that “[t]he purpose of the notice of financial incentive is to explain to the consumer the material terms of a financial incentive or price or service difference the business is offering so that the consumer may make an informed decision on whether to participate.” 7 The Regulations note that if the business does not offer such an incentive, then no notice is required. 8

The principles for the formatting of the notice are very similar that that of the privacy policy, namely: 9

  • Use plain, straightforward language and avoid technical or legal jargon;
  • Use a format that draws the consumer’s attention to the notice and makes the notice readable, including on smaller screens, if applicable;
  • Be available in the languages in which the business provides contracts, disclaimers, sale announcements, and other information;
  • Be reasonably accessible to consumers with disabilities; and
  • Be readily available where consumers will encounter it before opting into the financial incentive or price or service difference.

Contents of the notice include the following: 10

1) A succinct summary of the financial incentive or price or service difference offered;
2) A description of the material terms of the financial incentive or price or service difference;
3) How the consumer can opt-in to the financial incentive or price or service difference;
4) A statement of the consumer’s right to withdraw from the financial incentive at any time and how the consumer may exercise that right; and
5) An explanation of how the financial incentive or price or service difference is reasonably related to the value of the consumer’s data.

With respect to calculating the value of consumer data, the Regulations state that “a business offering a financial incentive or price or service difference shall use and document a reasonable and good faith method for calculating the value of the consumer’s data.” 11 It offers the following as potential components of such a calculation: 12

1) The marginal value to the business of the sale, collection, or deletion of a consumer’s data or a typical consumer’s data;
2) The average value to the business of the sale, collection, or deletion of a consumer’s data or a typical consumer’s data;
3) The aggregate value to the business of the sale, collection, or deletion of consumers’ data divided by the total number of consumers;
4) Revenue generated by the business from sale, collection, or retention of consumers’ personal information;
5) Expenses related to the sale, collection, or retention of consumers’ personal information;
6) Expenses related to the offer, provision, or imposition of any financial incentive or price or service difference;
7) Profit generated by the business from sale, collection, or retention of consumers’ personal information; and
8) Any other practical and reasonably reliable method of calculation used in good-faith.

Finally, in the event that a consumer uses a global privacy control (such as a Do Not Track browser signal) when participating in business’s financial incentive program, the control will take precedence:

If a global privacy control conflicts with a consumer’s existing business-specific privacy setting or their participation in a business’s financial incentive program, the business shall respect the global privacy control but may notify the consumer of the conflict and give the consumer the choice to confirm the business-specific privacy setting or participation in the financial incentive program. 13 [emphasis added]


1. Cal. Civ. Code §1798.125(a)(2).
2. Cal. Civ. Code §1798.125(b)(1).
3. Cal. Civ. Code §1798.125(b)(2).
4. Cal. Civ. Code §1798.125(b)(3).
5. The CCPA Regulations §999.301(j).
6. The CCPA Regulations §999.336(b).
7. The CCPA Regulations §999.307(a)(1).
8. Id.
9. The CCPA Regulations §999.307(a)(2).
10. The CCPA Regulations §999.307(b)(1)-(5).
11. The CCPA Regulations §999.337(a).
12. The CCPA Regulations §999.337(a)(1-8).
13. The CCPA Regulations §999.315(d)(2).

Ready to get started?

Schedule a personalized demo with one of our data security experts to see Spirion data protection solutions in action.

Watch demo now
Discover, protect and comply.

Protect sensitive information with a solution that is customizable to your organizational needs. When your job is to protect sensitive data, you need the flexibility to choose solutions that support your security and privacy initiatives.

Governance Suite →

social icon
Industry Solutions

Not knowing where sensitive client financial data resides and failing to take the right security precautions can be a costly mistake for your organization. Find out how Data privacy is treated in your sector.

Read more →

  • Products
    • Sensitive Data Platform
    • Sensitive Data Finder
    • Sensitive Data Watcher
  • Solutions
    • What is sensitive data discovery?
    • What is data loss prevention?
    • What is data classification?
    • Security Use Cases
  • Compliance
    • News
    • Services
  • Need Help?
    • Customer Portal
    • 646-863-8301​​​​​​​​​​​​​​​​​​​​​
    • 3030 North Rocky Point Drive West,
      Suite 470
      Tampa, FL 33607
LATEST BLOG POSTS
  • From Reactive to Proactive: Achieving Data Privacy Through Automation
  • Industry-Specific Data Classification: Why One-Size-Fits-All Doesn’t Work
  • Why Sensitive Data Identification Is the Key to Proactive Data Privacy

© 2024 Spirion, LLC. All Rights Reserved

  • Legal
  • Privacy
  • Sitemap