Cookie Banner, California Request, and an EU Access Request at a Berlin SaaS Company
Northwind Analytics GmbH is a 240-person SaaS company headquartered in Berlin with a sales office in San Francisco. It processes account data for 38,000 business customers, of whom 4,200 are California residents; its marketing site uses a cookie banner where analytics and advertising cookies are pre-selected and users must untick them. The company relies on 'legitimate interest' for all cookie-based advertising, retains raw web logs for 36 months, and has just received a request from a California customer asking for 'all data you hold and the categories of sources'. The same week, an EU customer submitted an access request covering emails that include a colleague's disciplinary notes and a sales negotiation with a third party. The legal team asks whether the California request is in scope, whether the cookie setup is lawful, and how to respond to both requests within the respective deadlines. Budget for a consent management platform is approved but not yet procured.
1. Is Northwind subject to the CCPA/CPRA, and what are the most urgent compliance gaps on the marketing site? Explain the threshold analysis rather than listing thresholds.
Read the worked answer
Threshold analysis comes first. CCPA/CPRA applies to a for-profit entity doing business in California that meets one of three thresholds: annual gross revenue above the adjusted $25 million figure, buying/selling/sharing personal information of 100,000 or more consumers or households, or deriving 50% or more of annual revenue from selling/sharing personal information. The fact pattern gives 4,200 California residents, but that number alone is not a threshold; the 100,000 test concerns buying, selling, or sharing, not merely serving customers. The missing fact is gross revenue. If Northwind exceeds the revenue threshold, it is in scope; if not, it is likely out of scope unless one of the other two tests is met. The former B2B and employee exemptions no longer provide a blanket shield.
If in scope, the urgent gaps are: no 'Do Not Sell or Share My Personal Information' link, no notice at collection with retention disclosure, no recognition of opt-out preference signals such as Global Privacy Control, and no process for authorized agents. The EU side is separately unlawful: pre-ticked cookies are not valid consent under ePrivacy, and legitimate interest cannot substitute for consent for advertising cookies. A 36-month raw log retention also conflicts with storage limitation and the CCPA retention disclosure.
Conclusion: Confirm revenue before refusing the California request. Regardless of the CCPA answer, fix the banner and retention because the EU exposure is clear. The California request should be handled under CCPA timelines if the entity is in scope, and the refusal decision must be documented.
2. Recommend a lawful basis for the advertising cookies and the analytics cookies, and explain whether the banner can be fixed by changing the text or requires a technical change.
Read the worked answer
Advertising cookies: consent is the required basis under ePrivacy, not legitimate interest. The banner's pre-selected boxes fail the GDPR standard of a clear affirmative act (Art 4(11), Art 7), and the reasoning in Planet49 applies. Consent must be granular, informed, and as easy to refuse as to give.
Analytics cookies: the answer is jurisdiction- and design-specific. First-party, aggregated analytics with short retention and no cross-site tracking may fall outside consent in some Member States, but the safer and more defensible route is consent unless a documented exemption applies. Legitimate interest cannot override the ePrivacy consent rule.
Text versus technical change: a text change alone is insufficient. Non-essential cookies must not fire before a positive action; reject-all must be as prominent as accept-all; choices must be granular, with advertising separate from analytics; no pre-ticked boxes; consent must be revocable and logged. The current banner fires tags before interaction, so a consent management platform with cookie blocking is required. Also implement a CCPA opt-out link and Global Privacy Control if in scope.
Conclusion: consent for both categories, a technical CMP with blocking, and an updated record of processing. The approved budget should be used before the next campaign, not after.
3. Outline how to handle the two access requests, including third-party data and deadlines, and identify what would make refusal defensible.
Read the worked answer
EU request: respond within one month, extendable by two further months for complexity, generally free of charge. The disciplinary notes and third-party negotiation require redaction of third-party identifiers and confidential commercial terms, but the controller should not refuse the whole request. Tell the requester that redactions were made and why (Art 15(4) and recital 63). If the notes include the requester's own data, disclose that portion. Do not disclose another employee's data without a lawful basis or consent.
California request: verify identity; respond within 45 days, extendable by another 45; provide categories of personal information collected, sources, purposes, recipients, and specific pieces. 'All data' is a request for specific pieces and categories, not a demand for raw internal documents. Do not disclose trade secrets or third-party data, but explain the redaction.
Defensible refusal only on a statutory exception: manifestly unfounded or excessive, legal privilege, or a legal obligation that conflicts. The refusal must be documented and partial where possible. Log both requests, the redaction rationale, and any extension. Do not delete data in response to an access request. If the EU request is refused in full, the reasoning must be reviewable by a supervisory authority.