What steps does Constructor take to comply with the CCPA?

The California Consumer Privacy Act (CCPA) specifies of rules and guidelines pertaining to the processing of personal information. Constructor operates as a service provider under CCPA, collecting limited personal information from its business customers and de-identifying it for processing by truncating IP addresses. Constructor assigns randomized, anonymous identifiers to devices to support its personalization and behavioral learning features, and these identifiers are not linked to consumers across different services or platforms. Please refer to this guide for more information on the data we collect.

Constructor's business customers deploy Constructor's technology on their websites and applications to collect personal information from their consumers. Constructor collects this information as a service provider on behalf of the business customers and processes it solely to provide services.

Under the CCPA, "personal information" includes information that identifies, relates to, or could reasonably be linked to a particular consumer. Constructor collects behavioral data (such as search terms, product interactions, and purchase activity) that is tied to randomized device identifiers. While this data is de-identified and pseudonymized, Constructor acknowledges it may constitute personal information under the CCPA broad definition.

The CCPA defines a "Unique identifier" as:

"Unique identifier" or "Unique personal identifier" means a persistent identifier that can be used to recognize a consumer, a family, or a device that is linked to a consumer or family, over time and across different services, including, but not limited to, a device identifier; an Internet Protocol address; cookies, beacons, pixel tags, mobile ad identifiers, or similar technology; customer number, unique pseudonym, or user alias; telephone numbers, or other forms of persistent or probabilistic identifiers that can be used to identify a particular consumer or device. For purposes of this subdivision, "family" means a custodial parent or guardian and any minor children over which the parent or guardian has custody.

Constructor's randomized identifiers are designed to avoid meeting this definition because they: (1) are not persistent across different services, (2) are not linked to consumers across different platforms, and (3) cannot be used to recognize consumers outside of Constructor's specific service context. Additionally, Constructor truncates IP addresses by removing the last octet before using them for behavioral tracking, further reducing identification capabilities.

However, Constructor recognizes that under some interpretations, its identifiers and data processing practices may be subject to CCPA obligations. As a service provider, Constructor does not directly handle consumer rights requests. Consumers must submit CCPA requests to the business (Constructor's customer) that authorized the collection of their personal information. Constructor will assist its business customers in responding to such requests.

Constructor offers API methods to assist business customers in responding to consumer rights requests. Business customers can submit a request via the Tasks API by creating a task of type user_data_request. This API call will return a task ID, which can then be used to retrieve the task results. The results will include a link to a file containing the user's data.