I am involved with a small-scale open source CMS project. We've had a recent uptick of incoming emails concerning CCPA, with a similar boilerplate:<p>==8<==<p>To Whom It May Concern:<p>My name is [REDCATED], and I am a resident of Norfolk, Virginia. I have a few questions about your process for responding to California Consumer Privacy Act (CCPA) data access requests:<p>Would you process a CCPA data access request from me even though I am not a resident of California?
Do you process CCPA data access requests via email, a website, or telephone? If via a website, what is the URL I should go to?
What personal information do I have to submit for you to verify and process a CCPA data access request?
What information do you provide in response to a CCPA data access request?
To be clear, I am not submitting a data access request at this time. My questions are about your process for when I do submit a request.<p>Thank you in advance for your answers to these questions. If there is a better contact for processing CCPA requests regarding [REDACTED].com, I kindly ask that you forward my request to them.<p>I look forward to your reply without undue delay and at most within 45 days of this email, as required by Section 1798.130 of the California Civil Code.<p>Sincerely,<p>[REDACTED]<p>==8<==<p>I don't recognise any of the names (we're a small project, we know a lot of the users between us) and they're all using small / anonymous email providers. The emails arrive at an advertised email address, so it's not obviously a test to check for a warm human…or is it? A reply is sent with a link to our privacy policy, and a clarification that we don't store any user data outside of forum user accounts, and answers to the questions. It's a copy-paste job to send a reply, and it's done promptly, but I'm confused as to what's triggered the influx of emails. Am I missing something?
We've gotten similar emails to our support team. It looks like someone is doing a massive project to gather info on CCPA compliance. I have no idea what their intent is, but we just pointed them to our standard writeup and submission form, which we've had out on our site for a while now.
If you're actually really legally required to answer them, just write some generic text. Probably spam or some weird research, but better safe than sorry. And then you'll have a cool text if a real user happens to have concerns around CCPA
Maybe set up a formal process on your project for these requests, like a form on your web site. Email spam is super common. You’ll probably get less spam on a form request.<p>Talk to a CCPA expert.