California Consumer Privacy Act Enforcement Update: New Investigative Sweep of Streaming Services & Restoration of the CPPA’s Enforcement Authority

As 2024 gets underway, California's regulators have continued to press forward in seeking to enforce the California Consumer Privacy Act (CCPA). Two recent developments warrant mentioning.

CPPA Enforcement Authority Validated

On February 9, 2024, California's Third District Court of Appeal overruled a lower court's decision that sought to delay the California Privacy Protection Agency's (CPPA) enforcement authority of its regulations until March 2024.¹ The lower court held that because the CCPA regulations were not finalized by July 2022, as required by statute, enforcement could not begin until March 2024, one year after its finalization. However, in its ruling, the appellate court noted that, "[t]he statute does not unambiguously require a one-year gap between approval and enforcement regardless of when the approval occurs, and nothing . . . signals that the voters intended such a gap." The CPPA is the first consumer privacy dedicated agency in the United States. Businesses should note that the appellate court's decision continues to crystalize that California regulators intend to honor Californians' privacy rights and permit enforcement actions to continue apace.

CCPA Compliance Sweep of Streaming Services

On January 26, 2024, California Attorney General (Cal AG) Rob Bonta announced an "investigative sweep" to inspect the compliance of "popular streaming apps and devices," alleging their failure to comply with the CCPA provisions regarding opt-out mechanisms. According to the Cal AG, businesses that sell or share consumer personal information must offer "an easy mechanism for consumers who want to stop the sale of their data."

The CCPA has, since 2020, required covered businesses to give notice of their privacy practices and to allow consumers to opt out of the sale of their personal data or the sharing of their personal data for targeted advertising. The Cal AG offered three examples in its announcement of how streaming services in particular should implement those requirements: (1) Smart TVs should have an option in the settings menu of streaming apps for consumers to select a "Do Not Sell My Personal Information" option; (2) this opt-out selection should apply across multiple devices that the consumer has used to log in to that streaming account; and (3) the streaming service should make it easy for consumers to find their privacy policy explaining consumer rights under the CCPA.

The Cal AG did not specify what was meant by "popular streaming apps and devices" or how many companies this sweep includes. Nonetheless, all covered businesses who require consumers to create log-in accounts should endeavor to honor consumers' opt-out requests across their devises. For example, retailers who maintain mobile applications and websites to engage consumers should consider implementing mechanisms to recognize and honor consumer preferences as easily as items in a consumer's online shopping cart are simultaneously reflected across their devices.

Outlook

The Cal AG's office has conducted other investigative sweeps in its enforcement of the CCPA, including its protections of HR Data and Mobile App Compliance. Another sweep, investigating online retailers, resulted in the first CCPA settlement action with the beauty products retailer Sephora. As the CPPA has regained its enforcement power, covered businesses should remain vigilant as both, the Cal AG and CPPA, have the ability to ensure they comply with the CCPA. Of note, Michael Macko, Deputy Director of Enforcement for the California Privacy Protection Agency notes that "[t]his decision should serve as an important reminder to the regulated community: now would be a good time to review your privacy practices to ensure full compliance with all of our regulations."

_{1 See F. Paul Pitman et al., CPRA Enforcement Activity Underway Despite Court Ruling to Delay, White & Case (August 15, 2023) for more information on the lower court's decision.}

_{White & Case means the international legal practice comprising White & Case LLP, a New York State registered limited liability partnership, White & Case LLP, a limited liability partnership incorporated under English law and all other affiliated partnerships, companies and entities.}

_{This article is prepared for the general information of interested persons. It is not, and does not attempt to be, comprehensive in nature. Due to the general nature of its content, it should not be regarded as legal advice.}

_{© 2024 White & Case LLP}