California Privacy Protection Agency Publishes Enforcement Advisory On Data Minimization

In April 2024, the California Privacy Protection Agency ("CPPA") published "Applying Data Minimization to Consumer Requests," its first enforcement advisory emphasizing data minimization as a "foundational principle" of the California Consumer Privacy Act ("CCPA"). Although the advisory does not have the force of law, it provides important data minimization guidance for businesses under the CCPA's purview.

The advisory reflects the CPPA's enforcement actions concerning businesses' collection, use, retention, and sharing of consumer data. As discussed in our previous Commentary, the CCPA requires all such activity to be "reasonably necessary and proportionate" to achieve the business's purpose in collecting or processing the data. The CPPA has observed that certain businesses ask consumers to provide excessive and unnecessary personal information before processing consumer data requests.