California Attorney General Warns of Enforcement Focus on Mobile App Compliance with CCPA

On January 27, 2023 California Attorney General Rob Bonta ("Cal AG") announced a new enforcement sweep, aimed at businesses with mobile apps that do not comply with the California Consumer Privacy Act ("CCPA"). The enforcement sweep will target mobile apps that fail to offer consumers a mechanism to opt-out of the sale of their personal data or fail to honor the consumer opt-out requests that they receive. The sweep also targets businesses that have allegedly failed to process consumer opt-out requests submitted through an authorized agent, such as the Permission Slip app developed by Consumer Reports. The announced sweep follow a prior sweep by the Cal AG of the opt-out provisions of the CCPA, targeting online retailers, that resulted in a settlement in August 2022 with the beauty products company Sephora. The Cal AG has also conducted an enforcement sweep of businesses operating loyalty programs. This enforcement sweep specifically focuses on mobile apps in the retail, travel, and food service industries, "given the wide array of sensitive information these apps can access from our phones and other mobile devices." In his announcement of the sweep, the Cal AG urged the tech industry to "innovate for good—including developing and adopting user-enabled global privacy controls for mobile operating systems that allow consumers to stop apps from selling their data."

Unlike prior sweeps, where business were permitted 30 days to cure violations under the CCPA, amendments to the CCPA by the Consumer Privacy Rights Act ("CPRA") eliminated the cure provision as of January 1, 2023. With a right to cure no longer in effect, it is possible that this latest sweep could result in more enforcement actions and penalties. The CCPA does direct the California Consumer Protection Agency and any court to "consider the good faith cooperation of [a] business. . .in determining the amount of any administrative fine or civil penalty" for a violation of the CCPA. (§1798.199.100)

Businesses subject to the CCPA should expect the consumer opt-out mechanisms for mobile apps to be a new area of focus by the Cal AG. As such, proactive compliance assessment and timely remediation of any gaps should be a priority for 2023.

_{White & Case means the international legal practice comprising White & Case LLP, a New York State registered limited liability partnership, White & Case LLP, a limited liability partnership incorporated under English law and all other affiliated partnerships, companies and entities.}

_{This article is prepared for the general information of interested persons. It is not, and does not attempt to be, comprehensive in nature. Due to the general nature of its content, it should not be regarded as legal advice.}

_{© 2023 White & Case LLP}