California and New York Privacy for Influencer Agencies

What to take away

What CCPA and CPRA let an agency tool store about creators and audiences

California's consumer privacy law applies to for-profit businesses that meet its thresholds and do business in the state. Meeting any one of three is enough: annual gross revenue above the threshold, which the California Privacy Protection Agency's updated monetary thresholds in the CCPA set at $26,625,000 from January 1, 2025, up from $25,000,000; buying, selling or sharing the personal information of 100,000 or more California residents or households; or deriving half or more of annual revenue from selling or sharing California residents' personal information. Most mid-size and large agencies cross those thresholds through revenue or through the volume of consumer records they buy, receive or share.

Two states shape most agency privacy work. An agency with creators in California and New York answers to CCPA and CPRA for California residents while applying SHIELD Act safeguards to New York records.

The California Consumer Privacy Act (CCPA), explained for consumers and businesses by the California Attorney General's office, sets the baseline duties. Notice at collection, the right to know what is held, the right to delete and limits on selling or sharing personal information are all part of it.

CPRA amended the law and added correction, purpose limitation and a stricter reading of what counts as sensitive personal information. The California Privacy Protection Agency (CPPA) enforces the CCPA through administrative actions; the California Attorney General also has enforcement authority.

For an agency, the data in scope is wider than a client list. It includes creator contact details, rate cards, audience demographics from platform analytics, engagement exports and direct messages.

A creator is usually a business contact, but the law does not stop applying because someone invoices you. If the record identifies a California resident, it is personal information. That includes a personal email address used for a 1099-NEC or a phone number used for a shoot schedule.

Sensitive personal information is the category that trips up influencer teams. Precise geolocation, racial or ethnic origin, health data and sexual orientation sit there. A campaign brief that asks creators to disclose a health condition, or audience data segmented by ethnicity, pulls that category into your tool.

That changes what a tool may store. If the platform cannot tag sensitive fields, restrict them or exclude them, the agency carries the risk of holding data it has no stated purpose for.

Purpose limitation is the second constraint. CPRA expects collection to be reasonably necessary and proportionate to the purpose you disclosed. A tool that quietly enriches every creator record with third-party audience data is collecting beyond the brief.

Audience data is the harder half. Many influencer platforms license audience panels and append demographic estimates to creator profiles. If that panel data is matched to identified individuals rather than aggregated, it is personal information and needs a lawful basis and a notice.

Opt-out of sharing matters here. California gives consumers the right to opt out of sharing for cross-context behavioral advertising. If your tool passes creator or audience segments into a paid media pipeline, that path may be a share, and it needs a working opt-out.

The practical test before you buy: ask the vendor to list every field it stores, mark which are sensitive, and show where the notice at collection appears. If the answer arrives as a security page rather than a field list, the tool is not ready for a California agency.

One more limit sits outside state law. Campaigns involving minors bring in the Federal Trade Commission's Children's Online Privacy Protection Rule (COPPA), which restricts collection from children under 13 and shapes what a kid-facing campaign may gather through forms, comment moderation and creator applications.

FTC endorsement rules run alongside all of this. Disclosure obligations do not change what you may store, but they do mean the material terms of a paid partnership are recorded somewhere, and that record is personal information about the creator.

The New York SHIELD Act and breach notification duties for creator data

New York takes a different route. The SHIELD Act amended the state's data breach law to cover any person or business that owns or licenses private information of a New York resident, whether or not the business is in New York.

That reach matters for a Los Angeles agency with New York creators on the roster. You are in scope for those records even with no office, no employee and no server in the state.

The SHIELD Act also sets reasonable safeguard requirements. It does not prescribe a standard, but it expects administrative, technical and physical safeguards for private information. A vendor's security posture becomes part of your own compliance argument.

Private information under the law includes the usual identifiers plus account numbers, biometric data, and a username or email address combined with a password or security question. Creator platform logins, shared team credentials and influencer portal accounts all fall inside that.

Breach notification duties are the sharp edge. When private information is exposed, the business that owns or licenses the data must notify affected New York residents without unreasonable delay and notify three state bodies: the New York Attorney General, the New York Department of State and the New York State Police. The Attorney General notice goes through the Attorney General's Report a Data Breach portal, and it must be filed alongside the notices to individuals.

There is no minimum number of affected residents for notice to affected residents or the state agencies. If more than 5,000 New York residents are to be notified at one time, the business must also notify consumer reporting agencies without unreasonable delay about the timing, content and distribution of the notices and the approximate number of affected people. The 5,000-resident trigger is for consumer reporting agency notice, not for notice to residents or state agencies.

Separately, the New York State Division of Homeland Security and Emergency Services (DHSES) accepts cyber incident reports through its reporting channel. Use that route when applicable to the incident; it does not replace the SHIELD Act notices described above.

New York also requires notice to the state's Department of Financial Services for entities it regulates. Most agencies are not regulated entities, but holding-company parents with insurance or financial lines can be.

Incident response is where agency tool sprawl hurts. Creator data typically sits in a discovery platform, a campaign management tool, a shared drive and an email inbox at the same time. A breach in any one of them triggers the same notification duty.

Build the count before the incident. Keep a record of which tool holds which fields for New York residents, so the notification can state numbers rather than estimates. A security page will not give you that.

The safeguard duty is continuous, not a one-time audit. Access reviews, offboarding steps and vendor monitoring are the evidence an agency can produce if the Attorney General asks how private information was protected.

For agencies comparing tools, the SHIELD Act turns vendor security documentation into a purchase requirement. A platform that cannot describe its encryption, access controls and incident history in writing is a liability in New York.

Data retention settings agencies must configure in influencer platforms

Data retention settings in influencer platforms are a practical privacy control. Defaults and controls vary by vendor, so verify each tool’s actual retention period and deletion path before relying on it.

Retention is not one setting. It appears in several places, and each has a different owner.

The six places, and who usually owns each:

The first job is to find the retention control in each tool you already pay for. Many platforms put it under workspace settings, some under a data policy tab, and a few only change it through a support ticket.

Agencies booking creators in California and New York should set one window for both states and use the shorter one. CPRA purpose limitation and SHIELD Act safeguard duties both reward deleting records you no longer need.

Set retention against the campaign, not the relationship. A creator who worked with you in 2024 does not need their audience export held in 2027. Keep the contract and payment record where finance needs it, and let the platform drop the rest.

Audience data deserves the shortest window. Panel appends and demographic estimates age badly anyway, and they are the records most likely to be sensitive. If the campaign is over, the audience file has no purpose.

Payment and tax records are the exception. Creator payments reported on 1099-NEC or 1099-K need to be kept for the tax record retention period, so separate financial records from marketing records in the tool rather than keeping everything to satisfy one need.

Exports are the leak nobody watches. A retention setting inside the platform does nothing about the CSV a coordinator downloaded to a laptop. Set a rule for local copies and delete them on the same schedule.

Integrations deserve their own review. A sync that pushes creator records into a CRM or ad account keeps the data alive after the platform deletes it. Turn off the sync when the campaign ends, and confirm the receiving system has its own deletion path.

Here is the configuration checklist for each platform you keep:

Run the deletion test once per tool. Ask the vendor to delete a test record and show the confirmation. If the platform cannot evidence deletion, the retention setting is a promise rather than a control.

Access is part of retention. A former coordinator with a live login can export data long after the campaign closes. Pair every retention change with an access review, and treat seat removal as a privacy task, not just an admin one.

That access review connects to platform support terms: when a vendor can suspend or revoke seats, your ability to delete data on schedule depends on the contract, not on the interface.

Consumer rights requests: deletion, correction and opt-out inside agency workflows

Consumer rights request handling is the operational side of CCPA and CPRA. A creator, a creator's assistant, or a member of an audience can ask what you hold, ask for correction, ask for deletion, or opt out of sharing.

The clock is the first design constraint. California requires a response within 45 days of receiving a verifiable consumer request. A business may extend that period once by another 45 days when reasonably necessary, but it must tell the consumer about the extension within the initial 45-day period.

Intake is the usual failure point. Requests arrive in a campaign inbox, a creator's DM, a client's contact form and a phone call. If there is no single intake path, the clock starts unnoticed.

Name an owner. One role, not a committee, receives and logs every request. That person confirms identity, records the date, and opens a ticket that survives staff changes.

Verify identity proportionately. You need enough to confirm the requester is the person whose data you hold, without collecting more personal information than the request itself requires. Do not ask for a government ID by default.

Deletion is harder than it looks in influencer work. Creator data sits in the platform, in the client's ad account, in the agency's reporting exports and in the payment system. A deletion request has to reach all four.

Know the exceptions. Records needed for tax reporting, for an active contract dispute, or for detecting security incidents may be kept. Document the exception you rely on rather than deleting nothing.

Correction requests are common with creator profiles. A wrong address, a wrong rate, a wrong audience figure. Correct the record in the source system and check whether an integration copied the wrong value elsewhere.

Opt-out of sharing is the request agencies underestimate. If creator or audience segments flow into paid media, an opt-out has to stop that flow. Test it on a live campaign before you claim it works.

Requests from audiences are rarer but messier. A commenter whose handle appears in an engagement export may be a California consumer. You need a way to find and delete that record without breaking the campaign record.

Log everything. Date received, date verified, systems searched, action taken, exception applied, date closed. The log is the evidence if a regulator asks how requests were handled.

Train the people who touch creator data. A coordinator who deletes a creator record from one tool and leaves it in three others has created a compliance gap, not a deletion.

Vendor cooperation belongs in the contract. Ask how the vendor handles a deletion request that reaches them directly, how long it takes, and what confirmation you receive. A rights request workflow that stops at the agency boundary is incomplete.

Vendor contracts, subprocessors and where creator data may sit

Subprocessor data residency is a contract term, not a setting. Creator data may be stored, backed up and processed in several countries even when the vendor's headquarters is in the United States.

Ask for the subprocessor list before signature, and ask how you are notified when it changes. A list that lives only in a trust center page can change without your knowledge.

Residency matters for two reasons. First, contractual commitments to clients, especially in regulated sectors, may require data to stay in the country. Second, a breach or a government access request in another jurisdiction changes your notification analysis.

Subprocessor lists are usually drafted for enterprise clients with offices in California and New York, so a mid-size agency often has to ask twice. Put the request in writing and keep the reply with the contract.

Backups are the part vendors skip in conversation. A primary region in the United States with a backup region elsewhere still means creator data sits abroad. Ask where backups live and how long they are kept.

Support access is a residency question too. If support engineers outside the country can view creator records, that access belongs in the disclosure.

Deletion on exit is the clause to negotiate. The contract should state what happens to creator data at termination, how long the vendor keeps it, and what confirmation the agency receives.

Security requirements should reference a recognized framework. The National Institute of Standards and Technology (NIST) cybersecurity and privacy resources give agencies a vocabulary for encryption, access control, logging and incident response that vendors already understand.

A public-sector reference point helps in client conversations. The privacy and security policy pages of USA.gov show how a large organization states its data handling in plain terms, which is a useful model for an agency privacy notice.

Indemnity and notification timing are the commercial terms that decide how a breach feels. Ask for notification within a defined number of hours, not "promptly," and ask who pays for notification costs.

Audit rights matter more than certifications. A current certification is a snapshot. The right to ask questions annually, and to receive answers in writing, keeps the vendor accountable after the sales cycle ends.

Subprocessors change with product roadmaps. A feature that adds an AI enrichment vendor creates a new subprocessor, and creator data may flow to it by default. Ask how new subprocessors are announced and whether you can object.

Data residency and subprocessor terms belong in the same review as access and retention. Splitting them across legal and marketing teams is how gaps appear.

Applying privacy rules when evaluating agency tools

A privacy scorecard keeps a tool comparison honest. Score configuration, not promises, and score it the same way for every vendor.

Start with the fields. Ask each vendor for a field-level list of what it stores about creators and audiences, and mark which fields are sensitive. Vendors that cannot produce the list score zero on that line.

Then score the controls you can see in a trial. Retention settings, export permissions, audit logs, deletion confirmation and integration controls are all testable before you sign.

Weight the lines that carry legal risk. Breach notification support, subprocessor disclosure and residency terms should outweigh interface polish, because they decide what happens in the worst week.

Use the same privacy scoring sheet across vendors. For related agency compliance context, see the talent agency commission laws California checklist.

Document the evidence behind each score. A screenshot of a retention setting, a contract clause, a written answer from support. Scores without evidence drift back to the vendor's marketing claims.

Re-score annually. Retention defaults, subprocessor lists and residency terms change with product releases, and the tool that scored well last year may not hold its position.

Include the access model in the score. Who can grant seats, who can export, and what happens when a staff member leaves. Access control is a privacy control, and it is often the weakest line in an otherwise strong tool.

For creator-facing work, add the whitelisting access path. Granting a client or a creator access to ad accounts and handles raises its own questions, covered in whitelisting platform requirements, and those answers belong on the same sheet.

Discovery tools need a separate line for audience data. A discovery platform that appends third-party demographic estimates is collecting more than a search tool, and the scorecard should record what it appends and where it comes from.

Keep a short list of documents to request from every vendor: a data processing addendum, a subprocessor list, a retention schedule, an incident response summary and a deletion confirmation process. For a separate marketplace shortlist, see the creator marketplaces guide; this privacy review still requires the same documents from each vendor.

Score the exit path too. How data is returned, how it is deleted, and how long the vendor keeps a copy after termination. Tools that are hard to leave are hard to govern.

Finally, assign the scorecard to a named owner who reports to the data protection lead. A scorecard that lives in a shared drive and is never revisited is a document, not a control.

Common questions