People file lawsuits to test boundaries of California’s privacy law
“It’s kind of like throwing spaghetti at the wall.” That’s how Jessica Lee, partner and co-chair of the privacy, security and data innovation practice group at law firm Loeb and Loeb, described the approach people have taken when filing lawsuits against companies under the California Consumer Privacy Act.
California’s privacy law — which allows California residents to restrict companies’ ability to sell their personal information — has been notoriously ambiguous, so people have turned to the courts for clarity.
Many of the suits filed since the law went into effect Jan. 1, 2020, allege companies have failed to allow people to opt out from sale of their personal information or failed to disclose that the companies share people’s personal information with third parties, according to lawyers tracking CCPA lawsuits. Meanwhile, a spokesperson for California attorney general Xavier Becerra said the AG’s office has sent dozens of notices to companies demanding that they fix problems leading to noncompliance with the law.
A lawsuit testing phase is common when new laws are passed, said Alysa Hutnik, partner and chair of the privacy and security practice at law firm Kelley Drye and Warren. “Plaintiffs are trying to pressure-test all possible avenues.”
So far, because few of the cases related to these lawsuits have been concluded, the parameters for how the law can be applied remain murky. Lawyers interviewed for this story suggested no precedents have been set at this early stage.
Testing legal boundaries
The CCPA includes a private right of action that allows an individual or group to sue a company for data breaches that violate the law. However, in some cases, the individuals and groups of people filing these lawsuits are pushing the boundaries to test just what sorts of alleged violations they have the right to sue over according to the law, said lawyers tracking CCPA lawsuits.
In some cases, the lawsuits attempt to circumvent the CCPA’s private right of action limits by alleging companies have violated other California laws, such as the state’s Unfair Competition Law, according to data privacy and security lawyers. Some suits allege, for instance, that companies have made untrue statements if they claim they do not sell personal information when they actually pass it along to third-parties.
“The strategy seems to be to try boot-strapping CCPA onto some of the existing California privacy laws,” said Lee. Law firm Morrison Foerster reported this same trend.
Exactly how many CCPA-related lawsuits have been filed is unclear. Law firm Perkins Coie told Digiday that 101 lawsuits have been filed. Morrison Foerster, said in January, “Nearly 50 cases have been filed seeking damages under the CCPA, either in connection with data breaches or based on alleged violations of the Act’s other consumer rights (with even more using the CCPA to add context to other privacy-related claims).”
Dozens of notices to publishers from the California AG
Then there are the warnings. In addition to lawsuits, the California AG’s office has sent notices to firms such as retail, financial and health-related website publishers to inform them that they are not compliant with the law. These violations include failing to respond appropriately to people requesting their data be deleted or not sold or failing to update company privacy policies, according to Dominique Shelton Leipzig, partner and co-chair of ad tech privacy and data management practice at law firm Perkins Coie.
The “notices to cure” sent by the AG’s office give companies 30 days to make changes to comply with the law. The notices are not publicly available, and the number of notices sent is confidential, according to the California AG’s office spokesperson, who described the figure as being in the “dozens.”
Shelton Leipzig said some website publishers have received notices if their websites state only that they share data with “advertising partners” rather than listing specific partner companies by name.
Other enforcement notices have plucked at low-hanging fruit, said Dan Jaffe, group evp of government relations for the Association of National Advertisers. “It was often, ‘Where’s your opt-out button?’” he said.
A temporary cure
Firms that do not make adjustments to satisfy the AG’s demands within the 30-day remedy window may go into a negotiation period, said Lee. Then, if negotiations don’t lead to a satisfactory fix, she said, “That’s when we’ll start to see public enforcement by the attorney general.” That could come in the form of civil penalties of $7,500 for each post-notice violation.
The 30-day compliance leeway afforded companies that receive these types of notices will go away, though. California’s updated privacy law, the California Privacy Rights Act passed last year, which will replace the CCPA when it goes into effect Jan. 1, 2023, does not have that provision.
“The CPRA does not have the 30-day cure,” said Jaffe. “So things may become a little bit more intense.”
Publishers use subscriber-only events to sweeten subscription pitches
The Washington Post and The Information's events exclusively created for subscribers can add more value to paying readers.
‘Still understanding that behavior’: What BuzzFeed learned from a year of livestream shopping
BuzzFeed's shoppable live streams were watched for more than 1 million minutes in 2021.
Member ExclusiveMedia Buying Briefing: As independents set bullish goals for 2022, they grow their consultative powers
Many independent agencies enter 2022 extremely optimistic because they just closed the books on a banner '21. Will they be able to keep it up?
SponsoredHow the relationship between live events and mobile devices is evolving in 2022
Sponsored by AdColony The pandemic has accelerated changes in the way people consume content — and live events are part of that transformation. For advertisers, the questions are the kind on which campaign success depends: In what ways (and numbers) have people returned to watching sports, e-sports and events such as the Grammys? Are they […]
Tinuiti Report: Facebook still in hot demand with clients, despite Apple ATT hit
According to a report from agency Tinuiti, it clients increased their ad spend 32% YOY in Q4 on Facebook and its ever-growing cousin Instagram.
Member ExclusiveMedia Briefing: Publishers grapple with an existential crisis as they prepare for post-cookie landscape
This week's Media Briefing looks at why some publishers would prefer to completely reset the online ad market amid the third-party cookie's demise rather than repeat the problems the cookie introduced.