People file lawsuits to test boundaries of California’s privacy law
“It’s kind of like throwing spaghetti at the wall.” That’s how Jessica Lee, partner and co-chair of the privacy, security and data innovation practice group at law firm Loeb and Loeb, described the approach people have taken when filing lawsuits against companies under the California Consumer Privacy Act.
California’s privacy law — which allows California residents to restrict companies’ ability to sell their personal information — has been notoriously ambiguous, so people have turned to the courts for clarity.
Many of the suits filed since the law went into effect Jan. 1, 2020, allege companies have failed to allow people to opt out from sale of their personal information or failed to disclose that the companies share people’s personal information with third parties, according to lawyers tracking CCPA lawsuits. Meanwhile, a spokesperson for California attorney general Xavier Becerra said the AG’s office has sent dozens of notices to companies demanding that they fix problems leading to noncompliance with the law.
A lawsuit testing phase is common when new laws are passed, said Alysa Hutnik, partner and chair of the privacy and security practice at law firm Kelley Drye and Warren. “Plaintiffs are trying to pressure-test all possible avenues.”
So far, because few of the cases related to these lawsuits have been concluded, the parameters for how the law can be applied remain murky. Lawyers interviewed for this story suggested no precedents have been set at this early stage.
Testing legal boundaries
The CCPA includes a private right of action that allows an individual or group to sue a company for data breaches that violate the law. However, in some cases, the individuals and groups of people filing these lawsuits are pushing the boundaries to test just what sorts of alleged violations they have the right to sue over according to the law, said lawyers tracking CCPA lawsuits.
In some cases, the lawsuits attempt to circumvent the CCPA’s private right of action limits by alleging companies have violated other California laws, such as the state’s Unfair Competition Law, according to data privacy and security lawyers. Some suits allege, for instance, that companies have made untrue statements if they claim they do not sell personal information when they actually pass it along to third-parties.
“The strategy seems to be to try boot-strapping CCPA onto some of the existing California privacy laws,” said Lee. Law firm Morrison Foerster reported this same trend.
Exactly how many CCPA-related lawsuits have been filed is unclear. Law firm Perkins Coie told Digiday that 101 lawsuits have been filed. Morrison Foerster, said in January, “Nearly 50 cases have been filed seeking damages under the CCPA, either in connection with data breaches or based on alleged violations of the Act’s other consumer rights (with even more using the CCPA to add context to other privacy-related claims).”
Dozens of notices to publishers from the California AG
Then there are the warnings. In addition to lawsuits, the California AG’s office has sent notices to firms such as retail, financial and health-related website publishers to inform them that they are not compliant with the law. These violations include failing to respond appropriately to people requesting their data be deleted or not sold or failing to update company privacy policies, according to Dominique Shelton Leipzig, partner and co-chair of ad tech privacy and data management practice at law firm Perkins Coie.
The “notices to cure” sent by the AG’s office give companies 30 days to make changes to comply with the law. The notices are not publicly available, and the number of notices sent is confidential, according to the California AG’s office spokesperson, who described the figure as being in the “dozens.”
Shelton Leipzig said some website publishers have received notices if their websites state only that they share data with “advertising partners” rather than listing specific partner companies by name.
Other enforcement notices have plucked at low-hanging fruit, said Dan Jaffe, group evp of government relations for the Association of National Advertisers. “It was often, ‘Where’s your opt-out button?’” he said.
A temporary cure
Firms that do not make adjustments to satisfy the AG’s demands within the 30-day remedy window may go into a negotiation period, said Lee. Then, if negotiations don’t lead to a satisfactory fix, she said, “That’s when we’ll start to see public enforcement by the attorney general.” That could come in the form of civil penalties of $7,500 for each post-notice violation.
The 30-day compliance leeway afforded companies that receive these types of notices will go away, though. California’s updated privacy law, the California Privacy Rights Act passed last year, which will replace the CCPA when it goes into effect Jan. 1, 2023, does not have that provision.
“The CPRA does not have the 30-day cure,” said Jaffe. “So things may become a little bit more intense.”
Magna 2023 forecast paints a resilient U.S. market, thanks to retail media and streaming
In its latest ad forecast, Magna is expecting a resilient U.S. market this year – boosted by retail, streaming and the auto industry’s bounceback.
How agencies are shaping the future of DEI beyond their own walls
Agencies are acknowledging that diversity efforts don’t stop with their companies. In addition to improving employee representation, now agency efforts in diversity, equity and inclusion are aimed at supporting clients and external partners.
Newsletter publishers say they continue to see uptick in revenue despite advertising slowdown
At a time when larger media companies are feeling the pressure of the economic downturn and advertising slowdown, newsletter businesses continue to be in a period of revenue growth.
SponsoredHow advertisers are fostering more effective publisher partnerships
Michael Weaver, senior vice president, business development and growth, Al Jazeera Media Network An everyday conversation between publishers and advertisers goes like this: The publisher invites the advertiser to a meal to talk about their business, attempts to delve into specifics on what the media buyer is looking to achieve, their audience breakdown and how […]
TikTok’s CEO faces bipartisan skepticism in first Congressional hearing on security concerns
The hearing comes amid calls to remove TikTok from government devices and in some cases even ban it entirely.
Media Briefing: What to expect at the Digiday Publishing Summit
As DPS draws nearer, top pain points for publishers are coming to light.