People file lawsuits to test boundaries of California’s privacy law
“It’s kind of like throwing spaghetti at the wall.” That’s how Jessica Lee, partner and co-chair of the privacy, security and data innovation practice group at law firm Loeb and Loeb, described the approach people have taken when filing lawsuits against companies under the California Consumer Privacy Act.
California’s privacy law — which allows California residents to restrict companies’ ability to sell their personal information — has been notoriously ambiguous, so people have turned to the courts for clarity.
Many of the suits filed since the law went into effect Jan. 1, 2020, allege companies have failed to allow people to opt out from sale of their personal information or failed to disclose that the companies share people’s personal information with third parties, according to lawyers tracking CCPA lawsuits. Meanwhile, a spokesperson for California attorney general Xavier Becerra said the AG’s office has sent dozens of notices to companies demanding that they fix problems leading to noncompliance with the law.
A lawsuit testing phase is common when new laws are passed, said Alysa Hutnik, partner and chair of the privacy and security practice at law firm Kelley Drye and Warren. “Plaintiffs are trying to pressure-test all possible avenues.”
So far, because few of the cases related to these lawsuits have been concluded, the parameters for how the law can be applied remain murky. Lawyers interviewed for this story suggested no precedents have been set at this early stage.
Testing legal boundaries
The CCPA includes a private right of action that allows an individual or group to sue a company for data breaches that violate the law. However, in some cases, the individuals and groups of people filing these lawsuits are pushing the boundaries to test just what sorts of alleged violations they have the right to sue over according to the law, said lawyers tracking CCPA lawsuits.
In some cases, the lawsuits attempt to circumvent the CCPA’s private right of action limits by alleging companies have violated other California laws, such as the state’s Unfair Competition Law, according to data privacy and security lawyers. Some suits allege, for instance, that companies have made untrue statements if they claim they do not sell personal information when they actually pass it along to third-parties.
“The strategy seems to be to try boot-strapping CCPA onto some of the existing California privacy laws,” said Lee. Law firm Morrison Foerster reported this same trend.
Exactly how many CCPA-related lawsuits have been filed is unclear. Law firm Perkins Coie told Digiday that 101 lawsuits have been filed. Morrison Foerster, said in January, “Nearly 50 cases have been filed seeking damages under the CCPA, either in connection with data breaches or based on alleged violations of the Act’s other consumer rights (with even more using the CCPA to add context to other privacy-related claims).”
Dozens of notices to publishers from the California AG
Then there are the warnings. In addition to lawsuits, the California AG’s office has sent notices to firms such as retail, financial and health-related website publishers to inform them that they are not compliant with the law. These violations include failing to respond appropriately to people requesting their data be deleted or not sold or failing to update company privacy policies, according to Dominique Shelton Leipzig, partner and co-chair of ad tech privacy and data management practice at law firm Perkins Coie.
The “notices to cure” sent by the AG’s office give companies 30 days to make changes to comply with the law. The notices are not publicly available, and the number of notices sent is confidential, according to the California AG’s office spokesperson, who described the figure as being in the “dozens.”
Shelton Leipzig said some website publishers have received notices if their websites state only that they share data with “advertising partners” rather than listing specific partner companies by name.
Other enforcement notices have plucked at low-hanging fruit, said Dan Jaffe, group evp of government relations for the Association of National Advertisers. “It was often, ‘Where’s your opt-out button?’” he said.
A temporary cure
Firms that do not make adjustments to satisfy the AG’s demands within the 30-day remedy window may go into a negotiation period, said Lee. Then, if negotiations don’t lead to a satisfactory fix, she said, “That’s when we’ll start to see public enforcement by the attorney general.” That could come in the form of civil penalties of $7,500 for each post-notice violation.
The 30-day compliance leeway afforded companies that receive these types of notices will go away, though. California’s updated privacy law, the California Privacy Rights Act passed last year, which will replace the CCPA when it goes into effect Jan. 1, 2023, does not have that provision.
“The CPRA does not have the 30-day cure,” said Jaffe. “So things may become a little bit more intense.”
‘Qualify the context’: Publishers see success with podcasts created to deepen coronavirus crisis coverage
Publishers expanded COVID-19 coverage with products like podcasts as audiences flocked to pandemic-related content.
California’s privacy law has had ‘no impact’ on ad revenues or inventory, but indirect effects could hurt
Publishers, ad tech firms and ad agencies say they felt a bigger hit from opt-ins in Europe than from opt-outs in California.
‘We need to see ourselves as a media business’: AC Milan’s endgame for content
Italian football club AC Milan has joined the likes of Chelsea, Real Madrid, Barcelona F.C and Bayern Munich in owning its production arm.
SponsoredShoppable content is reshaping brand and publisher relationships
In recent years, brands and publishers have adopted affiliate marketing as an increasingly established method to audiences. However, what may seem to be a mutually beneficial arrangement between brands and affiliates on closer scrutiny reveals itself as a solution that comes with challenges. Meanwhile, the emergence of content commerce is opening different approaches to matching […]
Member ExclusiveMedia Briefing: ‘I literally didn’t sleep last night’: Publishers share their concerns about the future of data
Publishing execs today face big questions about how to value their audiences and who holds the keys to that value.
‘Isolated and voiceless’: Burnt out young workers are turning to tech for mental health support
Gen Z workers think robots are more helpful than humans for mental health support — a factor that hints at deeper work-culture issues.