California Attorney General Releases Information about Its CCPA Enforcement Efforts

By‎ Adv. Dotan Hammer

Partner at the Cyber, Privacy & Copyright Group, Pearl Cohen Zedek Latzer Baratz

Reading time: 2 minutes
Save to "My Content"

The Attorney General of California (CAG), tasked with the exclusive power to enforce the California Consumer Privacy Act (CCPA), has published a rundown of its enforcement effort in the past year, to raise awareness of the importance of compliance with the CCPA.

Although the CAG does not usually release information about its investigations, it recently provided a list of illustrative examples of enforcement proceedings it has initiated across various sectors such as online marketing, social media, advertising, grocery retail, automotive and clothing retail. During the 12 months since the CCPA entered into effect last July, the Office of the Attorney General took the following enforcement steps, among other instances:

  • A business that provides an online dating platform and has sold personal information, did not have a “Do Not Sell My Personal Information” link on its homepage and did not have adequate disclosures about what personal information it has sold. The Attorney General found that the “accept sharing” button which the user had to click on when creating an account, is insufficient to establish consent. The CAG ordered the platform to amend its privacy policy and add the required link to its homepage.
  • A business that operates a mobile app game has integrated a third-party mobile advertising tool into the app. That tool shared the personal information of players, including minors aged 13 to 15 years old. The business did not provide an opt-out mechanism for adults or an opt-in mechanism for minors, as required by the CCPA. After being notified of the alleged non-compliance, the business removed the ad platform and established other privacy protections directed at younger users.
  • A media conglomerate required consumers to submit multiple, separate requests to opt-out of the sale of their personal information, on each website in its portfolio. The Attorney General ordered the media conglomerate to amend its opt-out process to streamline opt-out requests.

In addition, in an update to its Q&A page, the Attorney General provided clarifications regarding the Global Privacy Control (GPC) mechanism, available on certain browsers such as DuckDuckGo, and as a plug-in for other browsers such as Chrome. The GPC enables consumers to flag their choice to opt out of the sale of their personal information. According to the Attorney General, any business that collects and sells the personal information of consumers online must honor consumers’ GPC opt-out settings as valid requests to stop the sale of personal information.

Click HERE to read the Attorney General’s publication on enforcement proceedings.

Click HERE to read the Attorney General’s Q&A page.