Over the past month, most everyone, whether a California resident or not, has received notices from numerous online companies encouraging users to review updates made to the companies’ terms of use and privacy policies. These seemingly synchronized updates are certainly not a coincidence, but rather last-minute efforts to wrap up compliance with the California Consumer Privacy Act (CCPA), which is set to go in effect on New Year’s Day.

Coming on the heels of Europe’s GDPR, the CCPA is the most comprehensive set of online privacy regulations in the U.S. The new rights granted to consumers under the CCPA include:

• The right to know what personal information is collected, used, shared or sold, both as to the categories and specific pieces of personal information;

• The right to delete personal information held by businesses and by extension, a business’s service provider;

• The right to opt-out of sale of personal information. Children under the age of 16 must provide opt in consent, with a parent or guardian consenting for children under 13.

• The right to non-discrimination in terms of price or service when a consumer exercises a privacy right under CCPA.

Businesses are subject to the CCPA if one or more of the following are true:

• It has gross annual revenues in excess of $25 million;

• Buys, sells or receives the personal information of 50,000 or more consumers, households, or devices; or

• Derives 50 percent or more of annual revenues from selling consumers’ personal information.

The burden imposed by the CCPA is significant, as it not only requires companies to overhaul their websites to ensure that all notices and opt-out links are provided to users, but it also likely requires changes to company internal procedures and employee training in order to maintain compliance.

Violations of the CCPA create private causes of action for consumers, and also empowers the CA Attorney General (AG) to pursue cases against businesses for damages of up to $7,500 per violation for intentional, or willful violations. So, the countdown is on for companies to contact a privacy attorney and, at a minimum, take steps to reduce exposure to private suits. AG enforcement isn’t set to begin until mid-2020, so there is still time to get your reindeer in a row.

JDI Dating has entered into a settlement order that prohibits them from selling or benefiting from customers’ personal information, and to refund fees to the duped daters.

This case highlights two important issues that the FTC does not hesitate to prosecute: negative option marketing and violation of privacy policies.

Negative Option Marketing is where a seller automatically signs the consumer up for a product or service with a recurring fee, unless the consumer chooses not to receive the offer. The law states that before charging a consumer for any goods or services sold in an internet transaction via a negative option feature, the person/company must:

-provide text that clearly discloses all material terms of the transaction before obtaining the consumer’s billing information;

-obtain a consumer’s express informed consent before charging the consumer; and

-provide a simple method for a consumer to stop recurring charges.

Privacy:  JDI’s practices make us question whether its use of consumer information was disclosed in its privacy policy.  It is necessary to accurately disclose to consumers how you will use their information and whether it will be shared with third parties.

Contact Digital Law Group if you need assistance with your billing and privacy practices.