Last week, the FTC announced its release of a staff report discussing key topics from the April 29, 2021 workshop addressing dark patterns. The report states that the FTC will take action when companies employ dark patterns that violate existing laws, including the FTC Act, ROSCA, the TSR, TILA, CAN-SPAM, COPPA, ECOA, or other statutes and regulations enforced by the FTC. The report highlights examples of cases in which the FTC used its authority under these laws and regulations to bring enforcement actions against companies that allegedly used dark patterns. Accordingly, the report builds upon the FTC’s historical approach of using its existing authority to bring enforcement actions in this context.
California Privacy Protection Agency Holds Public Hearings on Proposed Regulations
The California Privacy Protection Agency (“CPPA”) held two public hearings last week on its proposed regulations.
Continue Reading California Privacy Protection Agency Holds Public Hearings on Proposed Regulations
California’s Office of the Attorney General Posts 13 New CCPA Investigations
On August 24, 2022, the California Office of Attorney General (OAG) published a summary of 13 CCPA investigations, “illustrative” of situations in which notices of alleged noncompliance were sent and remedial measures were implemented. Note that the CCPA’s mandatory notice-and-cure period will expire on January 1, 2023. Following that, the California Privacy Protection Agency will have the discretion to grant cure periods.
Continue Reading California’s Office of the Attorney General Posts 13 New CCPA Investigations
California Attorney General Announces First CCPA Settlement
Today, the California Attorney General announced the first settlement agreement under the California Consumer Privacy Act (“CCPA”). The Attorney General alleged that online retailer Sephora, Inc. failed to disclose to consumers that it was selling their information and failed to process user requests to opt out of sale via user-enabled global privacy controls. The Attorney General also alleged that Sephora did not cure these violations within the cure period.
Continue Reading California Attorney General Announces First CCPA Settlement
The CPPA Meets on May 26th, 2022
The California Privacy Protection Agency (“CPPA”) held a board meeting on May 26th, 2022. At the meeting, Executive Director Ashkan Soltani, Acting General Counsel Brian Soublet, and members of the Board offered insight into the following key topics:
California Privacy Protection Agency Staff Posts Draft Rules Implementing the CPRA
In advance of the June 8, 2022 board meeting, the California Privacy Protection Agency (CPPA) staff has posted draft rules implementing the California Privacy Rights Act (CPRA). The draft regulations keep much of the pre-existing California Consumer Privacy Act (CCPA) regulations intact, but modify certain provisions and propose new regulations. A copy of the proposed
Connecticut Legislature Passes Comprehensive Privacy Bill
The Connecticut legislature passed Connecticut SB 6 on April 28, 2022. If signed by the governor, the bill would take effect on July 1, 2023, though the task force created by the bill will be required to begin work sooner.
The bill closely resembles the Colorado Privacy Act, with a few notable additions. Like the Colorado Privacy Act, the bill adopts “controller” and “processor” terminology, provides consumers with rights to access, correct, delete, obtain a copy, and opt-out of certain types of processing of their personal data, and requires consent for certain activities.
Continue Reading Connecticut Legislature Passes Comprehensive Privacy Bill
Colorado Attorney General Remarks on CPA Rulemaking
On April 12, at the International Association of Privacy Professionals’ global privacy conference, Colorado Attorney General Phil Weiser gave remarks on his office’s approach to the rulemaking and enforcement of the Colorado Privacy Act.
Continue Reading Colorado Attorney General Remarks on CPA Rulemaking
Utah Legislature Passes Comprehensive Privacy Bill
Utah appears poised to be the next state with a comprehensive privacy law on its books, following California, Virginia, and Colorado. On March 2nd, the Utah House of Representatives voted unanimously to approve an amended version of the legislative proposal, and the Senate concurred with the House amendment on the following day. Formalities are now being completed to send the bill to Governor Spencer Cox for signature.
The Utah Consumer Privacy Act (“UCPA”) provides for consumer rights and responsibilities for controllers and processors. Although the bill generally tracks the comprehensive privacy law passed in Virginia last year, the VCDPA, there are some notable differences. Key provisions in the bill include the following:
Continue Reading Utah Legislature Passes Comprehensive Privacy Bill
California Legislature Introduces Bills To Extend Employment and Business-To-Business Data Exemptions
As companies begin to prepare their CPRA compliance strategies, they are grappling with whether to include personal information processed in employment and business-to-business contexts. Currently, the CPRA’s partial exemptions for both of those types of data sunset on December 31, 2022. However, last week, the CA legislature introduced AB 2871 and AB 2891. AB