This summer has been filled with legal changes that significantly impact businesses that sell online. The California Consumer Privacy Act of 2018 will impact the way businesses collect, store, and sell customers’ private information, and the recent case of South Dakota v. Wayfair will change the way online retailers handle sales tax.

California Consumer Privacy Act of 2018

The California Consumer Privacy Act of 2018 (“Act”), passed by the California state legislature on June 28, 2018, requires businesses to disclose the type of private consumer information it collects, the business-related reason for collecting the private consumer information, and the third parties that receive the private consumer information from the business. Without fear of price increase retaliation or a change in the level of their service, Californians will be able to request that businesses delete or refrain from selling their personal information. Although businesses cannot punish customers that choose this option, businesses can offer “financial incentives” to customers that allow their personal information to be collected and sold by the business.

The Act’s applicability is not limited to California-based businesses. It applies to businesses that collect information from California residents and either (a) have an annual revenue of $25 million or more; (b) hold the personal information of more than 50,000 “consumers, households, or devices;” or (c) one half (1/2) or more of the business’s annual revenue is earned by selling consumers’ personal information. The Act’s application to international companies has not yet been clarified. The impact will be widespread, with more than 500,000 domestic businesses being impacted. Because so many businesses will be impacted, the Act has effectively created a national standard for the collection and retention of consumers’ private information.

The Act will come into effect January 1, 2020. This delay between the time of enaction and the time it will come into effect provides legislators with an opportunity to amend the Act. The prospect of changes to the Act creates uncertainty for businesses seeking to come into compliance.

Businesses will need to make both external-facing and internal-facing changes to come into compliance with the current form of the Act. Externally, businesses must ensure that customers can request that their information be deleted and can opt out of having their information sold. The Act requires that businesses, at a minimum, provide customers with a toll-free telephone number and website address that will allow them to communicate their requests. Internally, businesses should develop a process for responding to, and carrying out, customer requests for having their information deleted or withheld from third party sales.

Businesses that do not comply with the Act are subject to enforcement by the California Attorney General and lawsuits from consumers. Businesses that violate the Act may be subject to damages ranging from $100 to $750 per violation in lawsuits from consumers if the businesses does not cure alleged violation(s) within thirty (30) days.

South Dakota v. Wayfair

On June 21, 2018, in a 5-4 split decision, the United States Supreme Court held that businesses do not have to have a physical presence in a state for that state to require the business to collect and pay the state sales tax. Many states have laws taxing the retail sale of goods and services within the state. Prior to the court’s decision in South Dakota v. Wayfair, states could not require businesses with no physical presence in their state to collect sales tax on goods shipped to consumers within the state. Instead, in-state consumers are responsible for paying a use tax at the same rate. Consumer compliance rates are extremely low, causing states to lose millions of dollars in tax revenue every year. To combat this loss of sales tax revenue, South Dakota enacted a law that requires out-of-state businesses that deliver over $100,000 of goods or services into the state or make 200 or more separate transactions for delivery of goods or services into the state to collect sales tax “as if the seller had a physical presence in the state.” Wayfair, Inc. challenged the constitutionality of the law. The Supreme Court upheld South Dakota’s law.

Because businesses no longer need to have a physical presence in a state for the state to require the collection and payment state sales tax, companies will need to invest in technology that can determine the appropriate amount of sales tax to charge customers. Over 10,000 jurisdictions in the United States levy sales taxes, so determining the proper amount to collect will not be an easy task. To handle this complexity, business should stay up to date on current and pending state sales tax laws in all states the business sells to, and should consider the use of sales tax automation software.

Although having two substantial changes to the way online businesses operate occurring in the same month can be daunting to businesses that do a substantial amount of their work online, through proactive measures and diligently staying up to date with the possible changes in state law, businesses can stay in compliance with the legal and economic changes coming their way. Online retailers should monitor the status of the California Consumer Privacy Act of 2018, regardless of whether the retailer has a physical presence in the state, and plan on making changes to comply with the current form of the Act by late 2019. Online retailers should also periodically review their obligations to collect sales tax, as states which do not currently collect sales tax from out-of-state businesses will likely pass new laws to this effect in the wake of the South Dakota v. Wayfair decision.