On
The complaint filed by the AG's Office alleged that
-
Failing to disclose to consumers that it was selling their personal information.
- Affirmatively stating that it did not sell consumers' information when it fact it did have business relationships with third-parties to serve targeted ads based on a consumers' browsing history.
- Failing to provide a conspicuous "Do Not Sell My Personal Information" link in either its app or website.
- Process requests signaled by the Global Privacy Control.
- Implement and maintain a program to assess and monitor whether it is effectively processing requests and, for a period of two years, report its compliance to the AG.
- Privacy disclosures that were not understandable to the average consumer and did not include the required information.
- A "Do Not Sell My Personal Information" link that worked only on certain browsers and directed consumers to a confusing webpage that required several additional steps to submit CCPA requests.
- Businesses must allow customers to opt-out of data sharing. The Complaint shows that the AG views the CCPA's compliance requirements as straight-forward, and promises further enforcement for those businesses who continue to ignore the statutory mandate.
- It is uncertain whether the AG will continue to provide a 30-day cure period to businesses when they fail to comply. The CPRA brings many changes, including making the cure period discretionary to the AG, and businesses must evaluate their CPRA compliance now to ensure that they are not caught unaware come 2023.
The Complaint further notes that
The AG's press release underscores the AG's focus on large companies' compliance with the CCPA. It further notes that the AG's Office conducted a sweep to determine whether Global Privacy Control signals—which allow consumers to broadcast a "do not sell" signal across every website they visit without clicking a Do Not Sell link—were adequately received and respected by online retailers. According to the AG,
-
Provide notice to consumers if it sells their personal information, and give consumers the right to opt-out.
The AG further noted that his office notified more businesses on Wednesday that they were not compliant with the CCPA's opt-out requirements. While the AG is currently required to give businesses the statutory 30 days' right to cure, on
The press release also noted that the AG has included new examples of notices of non-compliance that have been sent to businesses, available here, and include CCPA compliance issues such as:
-
Loyalty programs that offered financial incentives such as discounts, free items, or other rewards, in exchange for personal information without providing consumers with a notice of financial incentive.
Takeaways
- The AG is focused on data tracking and third-party agreements. Businesses need to carefully assess and disclose whether they are "selling" consumer information. Conforming service provider agreements to the CCPA's requirements could assist with minimizing sales of personal information.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
Ms
2029 Century
CA 90067-3010
Tel: 202.887.4000
E-mail: Jlarivee@akingump.com; pazimi@akingump.com
URL: www.akingump.com
© Mondaq Ltd, 2022 - Tel. +44 (0)20 8544 8300 - http://www.mondaq.com, source