Effective Date: January 1, 2020
This California Privacy Notice (“Notice”) applies to “Consumers” as defined by the California Consumer Privacy Act (“CCPA”) and is a supplement to the Privacy Policy for the U.S. News Services (our “Privacy Policy”). Capitalized terms used but not defined in this Notice shall have the meanings given to them in our Privacy Policy. This Notice may be modified at any time and from time to time; the date of the most recent changes or revisions will appear on this page. In the event of any conflict between our Privacy Policy and this Notice, the terms of this Notice will prevail with respect to California Consumers.
1. PERSONAL INFORMATION WE COLLECT AND SHARE.
We may collect, use and disclose your personal information (“PI”) as required or permitted by applicable law. We collect the following categories of PI from the corresponding sources and for the corresponding purposes set forth in the table below. The table also includes information as to categories of third parties with whom PI is shared and the business and commercial purposes for selling (as broadly defined in the CCPA and which may exceed what you consider as “selling”) PI to third parties.
| Category of PI | Sources of PI | Business or Commercial Purposes for PI Collection | Categories of Third Parties with whom PI shared | Business or Commercial Purposes for Selling to Third Parties |
| 1. Identifiers which may include: · IP Address · Name · Address · Email Address · Phone Number · Age or Date of Birth · User ID | · Your device · You · U.S. News internal systems · Vendors · Marketing partners | · Processing and Managing Transactions · Security · Debugging · Performing Services · Research and Development · Quality Assurance · Marketing | · Marketing Partners · Vendors | · Processing and Managing Transactions · Security · Debugging · Performing Services · Quality Assurance · Marketing |
| 2. Personal Records which may include: · Name · Address · Email Address · Phone Number · Job title · Employer | · You | · Processing and Managing Transactions · Performing Services · Quality Assurance · Marketing | · Marketing Partners · Vendors | · Processing and Managing Transactions · Performing Services · Marketing |
| 3. Consumer Characteristics which may include: · Age or Date of Birth Gender | · You | · Performing Services · Quality Assurance · Marketing | · Vendors | · Processing and Managing Transactions · Marketing |
| 4. Customer Account Details / Commercial Information which may include: · User’s click path · Emails received, opened, clicked · Product information accessed · Goods or services purchased · Product subscription term | · Your device · You · U.S. News internal systems | · Processing and Managing Transactions · Security · Debugging · Performing Services · Quality Assurance · Marketing | · Marketing Partners · Vendors | · Processing and Managing Transactions · Security · Debugging · Quality Assurance · Marketing |
| 5. Internet Usage Information which may include: · User’s click path · Visitor status (new/returning) · Emails received, opened, clicked · Product information accessed · Product subscription term | · Your device · U.S. News internal systems | · Processing and Managing Transactions · Security · Debugging · Performing Services · Quality Assurance · Marketing | · Vendors | · Processing and Managing Transactions · Security · Debugging · Quality Assurance · Marketing |
| 6. Geolocation Data which may include: · Geolocation data | · Your device | · Security · Debugging · Performing Services · Marketing | · Vendors | · Processing and Managing Transactions · Security · Debugging Marketing |
| 7. Professional or Employment Information which may include: · Education level achieved · Employment status · Job title · Employer | · You | · Performing Services · Marketing | · Marketing Partners | · Marketing |
| 8. Inferences from PI Collected which may include: · Segment data | · Your device · U.S. News internal systems | · Processing and Managing Transactions · Security · Debugging · Performing Services · Quality Assurance · Marketing | · Vendors | · Processing and Managing Transactions · Security · Debugging · Quality Assurance · Marketing |
As permitted by applicable law, we do not treat deidentified data or aggregate consumer information as PI, and we reserve the right to convert, or permit others to convert, your PI into deidentified data or aggregate consumer information. We have no obligation to re-identify such information or to keep it longer than we need it just to be able to respond to your requests about such information.
We may collect, use and disclose your PI for commercial purposes such as for interest-based advertising and sharing PI in a manner that is deemed a sale under the CCPA. Subject to restrictions and obligations of the CCPA, our marketing partners, vendors (including those that facilitate interest-based and other advertising and marketing), and/or other third parties may also use your PI for some or all of the above listed business purposes.
Our vendors may themselves process personal information for business purposes or operational purposes, including processing to detect data security incidents, protecting against fraudulent or illegal activity, creation of datasets of aggregate consumer information and deidentified information, appointing subprocessors, and any other business purpose or operational purpose permissible under the CCPA.
If you direct us to share your PI we may, and that is not a sale. Also, disclosures amongst the entities that operate the U.S. News Services are not a sale of your PI.
Notwithstanding anything to the contrary in our Privacy Policy, we typically restrict use of your PI that is governed by the CCPA’s Consumer rights provisions and is shared with our vendors to business purposes, or we treat such disclosures as sales of your PI subject to your Do Not Sell rights.
While there is not yet a consensus, data practices of third party cookies and tracking devices associated with the U.S. News Services may constitute a “sale” of your PI as defined by the CCPA. Please see the “Use of Cookies” section of our Privacy Policy for more information about cookies and other tracking technologies and your choices regarding certain kinds of online interest-based advertising.
2. CCPA PRIVACY RIGHTS.
We provide California Consumers the privacy rights under the CCPA as described in this section 2. You have the right to exercise these rights via an authorized agent who meets the agency requirements of the CCPA and related regulations. As permitted by the CCPA, any request you submit to us is subject to an identification process (“Verifiable Consumer Request”). We will not fulfill your CCPA request unless you have provided sufficient information for us to reasonably verify you are the Consumer about whom we collected PI.
To make a request according to your rights to know or to request deletion of your PI as set forth below, please submit a request through our California Consumer Rights Request Form or by contacting us at [email protected] and respond to any follow up inquiries we may make. We will take steps to verify your identity before complying with the request to protect your privacy and security using your email address. We will send you an email to the email address that you provide to us, and you must take action as described in the email. This will enable us to verify that the person who made the request controls and has access to the email address associated with the request. We will check our systems for the email address and any information associated with the email address. If you provide us with an email address that has not been used to interact with us on the U.S. News Services, then we will not be able to verify your identity. In other words, the only reasonable method by which we may verify the identity of individuals is if we have an email address on file that was provided to us in relation to the U.S. News Services. We will be unable to fulfill your request if we cannot verify your identity. We reserve the right to modify our verification procedures and may request additional information from you as needed or as required by applicable law.
Some PI we maintain about Consumers is not sufficiently associated with enough PI about the Consumer for us to be able to verify that it is a particular Consumer’s PI when a Consumer request that requires verification pursuant to the CCPA’s verification standards is made (e.g., clickstream data tied only to a pseudonymous browser ID). As required by the CCPA we do not include that PI in response to those requests. If we cannot comply with a request, we will explain the reasons in our response. You are not required to create an account with us to make a Verifiable Consumer Request. We will use PI provided in a Verifiable Consumer Request only to verify your identity or authority to make the request and to track and document request responses, unless you also gave it to us for another purpose.
We will make commercially reasonable efforts to identify PI that we collect, process, store, disclose and otherwise use and to respond to your California Consumer privacy rights requests. We will typically not charge a fee to fully respond to your requests; provided, however, that we may charge a reasonable fee, or refuse to act upon a request, if your request is excessive, repetitive, unfounded or overly burdensome. If we determine that the request warrants a fee, or that we may refuse it, we will give you notice explaining why we made that decision. You will be provided a cost estimate and the opportunity to accept such fees before we will charge you for responding to your request.
Consistent with the CCPA and our interest in the security of your PI, we will not deliver to you your social security number, an account password, or security questions or answers in response to a CCPA request; however, you may be able to access some of this information yourself through your account if you have an active account with us.
Your California Consumer privacy rights are as follows:
A. The Right to Know:
i. Information Rights:
You have the right to send us a request, no more than twice in a twelve-month period, for any of the following for the period that is twelve months prior to the request date:
- The categories of PI we have collected about you.
- The categories of sources from which we collected your PI.
- The business or commercial purposes for our collecting or selling your PI.
- The categories of third parties to whom we have shared your PI.
- The specific pieces of PI we have collected about you.
- A list of the categories of PI disclosed for a business purpose in the prior 12 months, or that no disclosure occurred.
- A list of the categories of PI sold about you in the prior 12 months, or that no sale occurred. If we sold your PI, we will explain:
- The categories of your PI we have sold.
- The categories of third parties to which we sold PI, by categories of PI sold for each third party.
Please note that PI is retained by us for various time periods and we do not have any obligation to retain it longer than we need it just to be able to respond to your requests, so we may not be able to fully respond to what might be relevant going back 12 months prior to the request.
ii. Obtaining Copies of PI:
You have the right to make or obtain a transportable copy, no more than twice in a twelve-month period, of your PI that we have collected in the period that is 12 months prior to the request date and are maintaining.
Please note that PI is retained by us for various time periods and we do not have any obligation to retain it longer than we need it just to be able to respond to your requests, so we may not be able to fully respond to what might be relevant going back 12 months prior to the request.
B. Delete:
Except to the extent we have a basis for retention under CCPA, you may request that we delete your PI that we have collected directly from you and are maintaining. Our retention rights include, without limitation, to complete transactions and services you have requested or that are reasonably anticipated, for security purposes, for legitimate internal business purposes, including maintaining business records, to comply with law, to exercise or defend legal claims, and to cooperate with law enforcement. Note also that we are not required to delete your PI that we did not collect directly from you.
You may alternatively exercise more limited control of your PI by opting out of receiving further emails by clicking “Unsubscribe” or “Manage my email preferences” in any email from U.S. News.
C. Do Not Sell:
You have the right to opt out of the sale of your PI by clicking here (which assumes that certain exchanges of data from cookies and tracking devices are classified as a “sale” of PI under CCPA). You will be able to select:
- Opt out of the sale of your PI maintained by U.S. News, and/or
- Opt out of the sale of your PI for purposes of interest-based advertising.
Please note that opting out of the sale of your PI for purposes of interest-based advertising does not mean that you will stop seeing ads on the U.S. News Services or that you will no longer see interest-based ads. You may still see ads on the U.S. News Services that are tailored to your interests based on PI that (i) is not sold by U.S. News, (ii) was sold to other digital advertising companies ninety (90) days or more before you opted out of sales of your PI for purposes of interest-based advertising, or (iii) is sold by sources from which you have not opted out.
As of the Effective Date of this Notice, the California Attorney General has not yet issued final regulations implementing CCPA, and there is not yet an industry consensus as to whether data practices related to third party cookies and tracking devices associated with the U.S. News Services constitute a “sale” of your PI as defined by CCPA. U.S. News has adopted certain technology solutions for exercising “do not sell” requests that have been developed by industry associations or individual companies, assuming that certain exchanges of data from cookies and tracking devices are classified as a “sale” of personal information under CCPA. However, not all of the third parties that provide features of, or interest-based advertising on, the U.S. News Services are currently participating in such technology solutions. To the extent that a third party does not participate in such technology solutions, U.S. News is unable to communicate to them any “Do Not Sell My Personal Information” instruction from you with respect to cookies and other tracking devices.
For more information about cookies and other tracking technologies used on the U.S. News Services and your choices regarding certain kinds of online interest-based advertising, please see the “Use of Cookies” section of our Privacy Policy.
We do not knowingly sell the PI of Consumers we know are under 16 unless we receive an opt-in from the Consumer who is at least 13 but under 16, or from the parent or guardian of a Consumer younger than 13. Consumers who opt-in to PI sales may opt-out at any time. If you think we may have unknowingly collected PI for sale of yourself or of your child under the age of 13, or if you are at least 13 but under 16, exercising the opt-out will stop our selling of the PI. We may sell PI of Consumers who are 16 or older that we collected before they turned 16.
D. Non-Discrimination:
We will not discriminate against you in a manner prohibited by the CCPA because you exercise your CCPA rights.
E. Ours and Others’ Rights:
Notwithstanding anything to the contrary, we may collect, use and disclose your PI as required or permitted by applicable law and this may override your CCPA rights. In addition, we need not honor any of your requests to the extent that doing so would infringe upon our or any other person or party’s rights or conflict with applicable law.
3. ADDITIONAL CALIFORNIA NOTICES.
In addition to CCPA rights, certain Californians are entitled to certain other notices, including:
A. Third Party Marketing and Your California Privacy Rights:
California’s “Shine the Light” law permits California residents to request certain information regarding our disclosure of PI to third parties for their own direct marketing purposes.
Separate from your CCPA rights set forth above you have the following additional rights regarding disclosure of your information to third parties for their own direct marketing purposes:
We may from time to time elect to share certain “personal information” (as defined by California’s “Shine the Light” law) about you with third parties for those third parties’ direct marketing purposes. California Civil Code § 1798.83 permits California residents who have supplied personal information, as defined in the statute, to us to, under certain circumstances, request and obtain certain information regarding our disclosure, if any, of personal information to third parties for their direct marketing purposes. If this applies, you may obtain the categories of personal information shared and the names and addresses of all third parties that received personal information for their direct marketing purposes during the immediately prior calendar year (e.g. requests made in 2019 will receive information about 2018 sharing activities). To make such a request, please provide sufficient information for us to determine if this applies to you, attest to the fact that you are a California resident and provide a current California address for our response. You may make this request by contacting us at [email protected]. Any such request must include “Shine the Light California Privacy Rights Request” in the first line of the description and include your name, street address, city, state, and ZIP code. Please note that we are only required to respond to one request per customer each year.
As these rights and your CCPA rights are not the same and exist under different laws, you must exercise your rights under each law separately.
B. California Minors:
Although our online service(s) are intended for an audience over the age of 18, any California residents under the age of eighteen (18) who have registered to use our online services, and who posted content or information on the service, can request removal by contacting us at [email protected], detailing where the content or information is posted and attesting that you posted it. We will then make reasonably good faith efforts to remove the post from prospective public view or anonymize it, so the minor cannot be individually identified to the extent required by applicable law. This removal process cannot ensure complete or comprehensive removal. For instance, third parties may have republished or archived content by search engines and others that we do not control.
