Search california consumer privacy act

Privacy World Week in Review

By Kristin Bryan on September 30, 2024

Posted in Artificial Intelligence, Australia, Compliance, Events, Federal Trade Commission (FTC), General, Illinois

In case you missed it, below are recent posts from Privacy World covering the latest developments on data privacy, security and innovation. Please reach out to the authors if you are interested in additional information.

2024 Data Privacy Thought Leadership Series

The Trade Practitioner Blog Features Post on Key Takeaways from the Proposed August 2024 DFARS Rule

The First Tranche of Australian Privacy Law Reform

Employment Law Worldview Features SPB’s Gabrielle Martin on New AI Legislation in Illinois

300 Days Since Biden’s AI Executive Order: What Have Federal Agencies Accomplished and What is on the Horizon?

AI Convention – A Global Framework for AI Principles

EVENTS THIS WEEK

State Privacy Law Roundup
📅October 3 | 9 – 10 a.m. PT
Speakers: Julia Jacobson, Kyle Dull
In the first half of 2024, seven new state consumer privacy laws were enacted and three state consumer privacy laws became effective (plus one on October 1, 2024). Eight more state consumer privacy laws will become effective in 2025 and the California Privacy Protection Agency (CCPA) continued its rulemaking activity. Plus, 2024’s American Privacy Rights Act could gain traction now that Congress is back in session after the August recess. Join us on October 3rd for a rundown on where we are and what’s ahead for 2025 in consumer privacy.

REGISTER

2024 Data Privacy Thought Leadership Series

By Squire Patton Boggs on September 26, 2024

Posted in Events, General

Join us for our Data Privacy Thought Leadership Series, where we dive into the latest trends shaping AI, marketing, and data monetization. With new state privacy laws, evolving regulatory requirements, and AI procurement challenges, this series offers practical insights to help you navigate the complex data privacy landscape.

Learn how to manage privacy assessments, stay compliant, and strengthen your data governance strategies to keep your organization ahead of the curve.

State Privacy Law Roundup

📅Thursday, October 3 | 9 – 10 a.m. PT

Speakers: Julia Jacobson, Kyle Dull

In the first half of 2024, seven new state consumer privacy laws were enacted and three state consumer privacy laws became effective (plus one on October 1, 2024). Eight more state consumer privacy laws will become effective in 2025 and the California Privacy Protection Agency (CCPA) continued its rulemaking activity. Plus, 2024’s American Privacy Rights Act could gain traction now that Congress is back in session after the August recess. Join us on October 3rd for a rundown on where we are and what’s ahead for 2025 in consumer privacy.

AI, Marketing, and Data Monetization: Understanding and Managing Consents, Opt-Outs, and Other Regulatory Requirements

📅Thursday, October 10 | Noon – 1 p.m. PT

Speakers: Kyle Fath, Niloufar Massachi, Gicel Tomimbang

The convergence of industry trends, business needs, and significant technology advances, particularly advancements in AI, marketing, and data monetization, has led many companies to collect more personal data and do more with it. This comes at a time when regulators are actively and aggressively pursuing privacy enforcement and over twenty states have passed comprehensive privacy laws, with most of them imposing consent obligations, opt-out rights, and even outright prohibitions with respect to specific activities or certain types of data.

Please join us for a discussion on consent, opt-out, and other regulatory requirements that are relevant to AI, marketing, and data monetization. Our goal is for you to leave this session armed with information that will help you identify risks, inform business decisions and strategy, and serve as a thoughtful and resourceful partner to your organization’s GC/CLO, business stakeholders, and C-suite.

Attend virtually or join us at our LA Office for further discussion and lunch.

Privacy Rulemaking and Enforcement

📅Thursday, October 17 | 9 – 10 a.m. PT

Speakers: Alan Friel, Lydia de la Torre

Join Squire Patton Boggs Global Data Chair Alan Friel and of Counsel Lydia de la Torre, and former CPPA Board member, for a discussion on the next generation of CCPA regulations, including regarding employment, ADM / Profiling / AI, and Risk Assessments and Security Audits, as well as enforcement priorities and cooperation between regulators in the states that have enacted consumer privacy laws.

Privacy Assessments: A Discussion of Requirements and Risks and a Mock Assessment Exercise

📅Tuesday, October 22 | Noon – 1 p.m. PT

Speaker: Kyle Fath

State privacy laws already require, or will soon require, companies to carry out assessments – referred to as data protection assessments, risk assessments or DPIAs. These requirements extend to “high-risk” activities or those that involve a “heightened risk of harm,” including, in most cases, targeted advertising, the sale of personal data, and the processing of personal data, among other things. The Colorado Privacy Act and proposed regulations under the California Consumer Privacy Act (CCPA) lay out detailed content requirements that companies must follow, including requiring significant input from both internal teams and external stakeholders, such as vendors and other recipients of personal data. In addition to prescriptive content requirements, businesses should also be aware of regulators’ ability to request copies of assessments under the state privacy laws, and the proposed CCPA regulations that would require businesses to file certifications of compliance and abridged versions of their assessments with the California Privacy Protection Agency.

Join us for this event where we will:

Discuss privacy assessment requirements and risks
Carry out a mock assessment exercise, walking through the completion of various aspects of a privacy assessment, focused on use cases involving targeted advertising and the sale of personal data
Touch on available resources that you can use to carry out assessments more efficiently and effectively

AI in Action: AI Procurement

📅Wednesday, October 30 | 9 – 10 a.m. PT

Speakers: Julia Jacobson

The same thing, only different. Procuring AI presents many of the same challenges as procuring any other technology. An organization seeks to harness the full potential of the technology together with a supplier contract that minimizes risks. Two key issues distinguish Al procurement: AI systems are designed to continually learn and improve and the AI legal structure is dynamic. Tune in for a trans-Atlantic view on adapting technology and data governance risk management for AI procurement.

Collecting Personal Information during Checkout: Balancing Consumer Rights with Business Marketing

By Julia Jacobson & Kyle Dull on September 3, 2024

Posted in Compliance, Consumer Protection, General, Personal Information Protection Law

Building a customer base is time-consuming and expensive. Engaging existing customers is often easier and more profitable than acquiring new customers. In the US, email and other targeted marketing is a low-cost and high-ROI way to foster this engagement, which makes collecting customers’ email addresses (and other personal information) a high priority for marketers. But, marketers beware: laws in California and Massachusetts that limit the collection of email addresses (and other personal information) at the point of purchase are an increasingly popular source of class action legal risk. While the laws in California and Massachusetts are popular with plaintiffs’ counsel now, several other states have similar laws, applying to different categories of information (e.g., some state laws only apply to address and telephone number) and transactions and varying enforcement mechanisms (e.g., criminal penalties or state attorney general enforcement).

Key Takeaways

Ensure that retail location staff understand that the collection of a customer’s personal information that is not required to complete a transaction must be the customer’s choice. Requesting a customer email address or other contact data during the purchase process – such as for tailored discounts and rewards – is permitted as long as the customer knows it is voluntary, i.e., not required to complete the purchase transaction. Further, to avoid errors and discourage claims clearly delineate subscriptions from transactions by separating sign-ups from purchases.
Check that etailer (i.e., e-commerce stores) purchase transaction flows do not require additional personal information that is not necessary to complete the transaction and clearly disclose to customers what is and is not required.
Beware of personal information collection by cookies, pixels and similar technology active on purchase transaction web pages.
Implement written policies and procedures – whether online or off – to document what personal information collected is mandatory vs. voluntary.

Are Data Practice Risk Assessments at Risk in the US?

By Alan Friel on August 22, 2024

Posted in California Age-Appropriate Design Code Act (“CAADCA”), CCPA, Compliance, Consumer Protection, DPIA

We have previously reported on the requirements, including mandatory risk assessments, of the California Age Appropriate Design Code Act, (CAADCA or Act) and that the Act was enjoined by a federal District Court as likely a violation of the publisher’s free speech rights under the First Amendment of the U.S. Constitution. The 9th Circuit has upheld that decision, but only as to Data Protection Impact Assessments (DPIAs), and gone further to find that such assessments are subject to strict scrutiny and are facially unconstitutional. See Netchoice, LLC v Rob Bonta, Atty General of the State of California (9th Cir., August 16, 2024) – a copy of the opinion is here. The Court, however, overruled the District Court as to the injunction of other provisions of CAADCA, such as restrictions on the collection, use, and sale of minor’s personal data and how data practices are communicated. Today, we will focus on what the decision means for DPIA requirements under consumer protection laws, including the 18 (out of 20) state consumer privacy laws that mandate DPIAs for certain “high-risk” processing activities.

Businesses Beware: New York Eyeing Privacy Regulation and Enforcement Even Absent Omnibus State Privacy Law

By Alan Friel on August 2, 2024

Posted in Compliance, New York

Regulators in states without omnibus state privacy laws, like New York, are staking their claim over privacy regulation and enforcement. After months of investigating the deployment of tracking technologies and privacy controls on various websites, the New York State Attorney General (“NY AG”) published its guidance, Website Privacy Controls: A Guide for Business. The NY AG also published a companion guidance for consumers, A Consumer Guide to Web Tracking, which provides a high-level overview of how websites track consumers and what steps consumers can take to protect their privacy. Stay tuned for potential enforcement actions and big-figure settlements. Will New York follow Texas in this regard?

NY AG Investigation and Findings

Tracking technologies, like cookies and tags (i.e., pixels), are utilized by businesses to collect and assess information regarding how individuals interact with the business’ website or mobile app. While tracking technologies can provide valuable insights for businesses, they also raise privacy concerns regarding data collection, selling, sharing, creation of detailed profiles about individuals that are used for targeted advertising, cross-site tracking that leads to a comprehensive understanding of an individual’s interests and behavior without the individual’s knowledge or consent, and more. The Federal Trade Commission (“FTC”) is attempting Section 5 Magnuson-Moss rulemaking on this, which they call surveillance capitalism.

Minnesota Makes 19: Will Rhode Island’s Privacy Law Replace Vermont’s Vetoed Privacy Law as #20?

By Julia Jacobson & Kyle Dull on June 21, 2024

Posted in Compliance, General, Minnesota, Rhode Island, Vermont

In a final push before adjourning for the summer, state legislators across the country contemplated consumer privacy laws. Three legislatures made it to the finish line. One – Minnesota’s state legislature passed the Minnesota Consumer Data Privacy Act on May 19^th as part of an appropriations bill, which was signed by Minnesota’s governor on May 24^th. Of the other two, one is pending gubernatorial action, and the other was vetoed.

The Rhode Island Data Transparency and Privacy Protection Act (RI-DTPA) was passed by the state legislature on June 13^th. Before RI-DTPA becomes law, Governor McKee must either sign, take no action or veto it. If signed, RI-DTPA is in force on January 1, 2026, like the Indiana Consumer Data Protection Act and Kentucky Consumer Data Privacy.

We are not, however, making assumptions about RI-DTPA’s passage. This post was originally planned to cover the Minnesota Consumer Data Privacy Act and the Vermont Data Privacy Act, not the RI-DTPA. On June 13^th (the same day that RI-DTPA was passed), Vermont’s Governor Phil Scott vetoed the Vermont Data Privacy Act. In his letter to Vermont’s General Assembly, Governor Scott noted that the Vermont Data Privacy Act created “big and expensive new burdens and competitive disadvantages for the small and mid-sized businesses Vermont communities rely on.” He also noted that the private right of action is “a national outlier, and more hostile” than any other state privacy law, notwithstanding its limited scope and sunset. He raised the possibility of a First Amendment challenge to the Age-Appropriate Design Code (Section 6), noting that “similar legislation in California has already been [preliminarily enjoined] for likely First Amendment violations.” (See here.) A veto override was not successful.

The RI-DTPA already faces opposition from privacy advocacy organizations claiming that RI-DTPA is too weak (see, e.g., here). Advertising associations also reportedly oppose RI-DTPA. Nonetheless, we have highlighted some key elements of RI-DTPA in this post so you can decide for yourself, together with answers to FAQs about the Minnesota Consumer Data Privacy Act (MN-CDPA) and how it is similar to and different from the other state consumer privacy laws.

Trending: Teens’ Data Subject to Heightened Restrictions Under Ten (and Counting?) State Privacy Laws

By Kyle Fath & Alan Friel on June 11, 2024

Posted in Children's Privacy, Compliance, COPPA, General

Since its inception in 1998, the Children’s Online Privacy Protection Act (COPPA) has been the cornerstone of protecting the personal data of minors under the age of 13 in the United States. COPPA imposes various requirements, including parental consent, notice and transparency, and data minimization, among other things, on online services that are “directed to children [under 13]” and “mixed audience” online services, or those that have actual knowledge that they have collected personal data from a child [under 13] online.

Many organizations that previously did not have to worry about COPPA or COPPA-based standards as applied to state consumer privacy laws should be aware of the trend in state privacy legislation to expand restrictions and obligations beyond COPPA’s under age 13 standard, to minors that are at least 13 and under the age of 18 (“Teens”). This trend began in 2020 with the California Consumer Privacy Act (CCPA) requiring consent for “sale” of personal information of consumers at least age 13 but younger than 16 years of age (the California Privacy Rights Act expanded that requirement to “sharing” as well). Consent must be given by the Teen or, if the consumer is under age 13, by the parent, using COPPA verification standards. Other relevant aspects regarding this trend, of which organizations should be aware, include:

State Privacy Law Patchwork Presents Challenges

By Alan Friel & Julia Jacobson on June 10, 2024

Posted in California, Children's Privacy, Colorado, Compliance, Connecticut, Consumer Protection, Cybersecurity, Data Privacy, Delaware, Florida, General, Indiana, Iowa, Kentucky, maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah, Vermont, Virginia

State legislatures across the country were busy in 2023 and so far this year passing comprehensive consumer privacy laws and creating a vexing patchwork of compliance obligations.

Legislatures in Iowa, Indiana, Tennessee, Montana, Florida, Texas, Oregon, Delaware, New Jersey, New Hampshire, Kentucky, Maryland, Nebraska and Minnesota all enacted consumer privacy laws of their own with an additional consumer privacy law in Vermont awaiting action by the Governor. The fifteen laws passed in 2023 and 2024 join laws in California, Virginia, Colorado, Utah, and Connecticut which already are in effect. A chart at the end of this blog post notes each law’s effective date, three of which are effective at the end of this month.

While inspired by the EU General Data Protection Regulation and the California Consumer Privacy Act (“CCPA”), the new state consumer privacy laws take materially different approaches in many ways. States also have passed more targeted privacy laws pertaining specifically to consumer health data (beyond treating it as a category of sensitive personal data), the protection of children (beyond limiting the use of personal data), AI-specific laws (not part of a comprehensive consumer data regime) and laws regulating data brokers (typically controllers that sell personal data they do not directly collect from consumers). Congress continues to consider a federal law that would mostly preempt the state consumer privacy laws, as well as other laws specific to children’s online safety with partial preemption. In the meantime, data controllers (and to a lesser degree processors) face the challenge of determining which state consumer privacy laws apply and whether to apply applicable laws based on consumer residency or to apply a national highest standard to all consumers.

The SPB privacy team has developed a comprehensive guide on state consumer privacy laws, including comparison charts on key issues to help determine which laws apply and tips for enhancing information governance. Most of the new state consumer privacy laws require controllers to conduct and retain documentation of data privacy impact or risk assessments. Minnesota’s new consumer privacy law also requires a documented privacy compliance program reasonably designed to ensure compliance and data inventories. The most recent draft of the federal privacy law mandates privacy-by-design.

Following are some highlights of the emerging ‘high water mark’ (strictest requirement) for key aspects of consumer privacy in the United States:

OneTrust DataGuidance Publishes Team SPB’s Comparison of the Kentucky, Maryland and Nebraska Consumer Privacy Laws – Part 1

By Julia Jacobson on May 15, 2024

Posted in Consumer Protection, Cybersecurity, Data Privacy, Maryland’s Online Data Privacy Act of 2024 (MODPA)

PrivacyWorld is pleased to report that the first part of a two-part article comparing Kentucky, Maryland and Nebraska’s new consumer privacy laws was published by OneTrust Data Guidance. These three state privacy laws were the 3rd, 4th and 5th laws enacted in 2024, following the new consumer privacy laws in New Hampshire and New Jersey enacted in January.