The California Attorney General recently announced a settlement with DoorDash to resolve allegations that DoorDash violated the California Consumer Privacy Act (CCPA) and the California Online Privacy Protection Act (CalOPPA). 

According to the complaint, this enforcement action arose from DoorDash’s alleged participation in a “marketing cooperative.”  The California Attorney General claimed that such cooperatives, where businesses disclose their customer’s personal information to the cooperative in order to mail advertisements to consumers on behalf of participants, constitute a “sale” under the CCPA.  The Attorney General alleged that DoorDash did not post a “Do Not Sell My Personal Information” link on its website and mobile app. 

The Attorney General sent DoorDash a “notice of alleged CCPA noncompliance” related to this behavior in 2020.  At the time, the CCPA provided for a cure period, which allowed businesses to avoid liability for CCPA violations if they cured the alleged violation within 30 days of notice.  However, although DoorDash had ceased participation in marketing cooperatives by the time it received the notice, the Attorney General took the position that DoorDash had not cured its previous sale of data because it did not “restore them to the same position they would have been in if their data had never been sold.”  

The complaint further alleges a CalOPPA violation because DoorDash did not disclose in its privacy policy that it shared personally identifiable information with marketing cooperatives.

Under the terms of the settlement, DoorDash will pay a civil penalty of $375,000.  The settlement reiterates DoorDash’s obligation to comply with both CCPA and CalOPPA, and specifically to disclose any future participation in marketing cooperatives in its privacy policy and notice at collection.  DoorDash must also implement and maintain a compliance program for three years, and report annually to the Attorney General summarizing its compliance program and certifying its compliance with the terms of the settlement.

Print:
Email this postTweet this postLike this postShare this post on LinkedIn
Photo of Lindsey Tonsager Lindsey Tonsager

Lindsey Tonsager co-chairs the firm’s global Data Privacy and Cybersecurity practice. She advises clients in their strategic and proactive engagement with the Federal Trade Commission, the U.S. Congress, the California Privacy Protection Agency, and state attorneys general on proposed changes to data protection…

Lindsey Tonsager co-chairs the firm’s global Data Privacy and Cybersecurity practice. She advises clients in their strategic and proactive engagement with the Federal Trade Commission, the U.S. Congress, the California Privacy Protection Agency, and state attorneys general on proposed changes to data protection laws, and regularly represents clients in responding to investigations and enforcement actions involving their privacy and information security practices.

Lindsey’s practice focuses on helping clients launch new products and services that implicate the laws governing the use of artificial intelligence, data processing for connected devices, biometrics, online advertising, endorsements and testimonials in advertising and social media, the collection of personal information from children and students online, e-mail marketing, disclosures of video viewing information, and new technologies.

Lindsey also assesses privacy and data security risks in complex corporate transactions where personal data is a critical asset or data processing risks are otherwise material. In light of a dynamic regulatory environment where new state, federal, and international data protection laws are always on the horizon and enforcement priorities are shifting, she focuses on designing risk-based, global privacy programs for clients that can keep pace with evolving legal requirements and efficiently leverage the clients’ existing privacy policies and practices. She conducts data protection assessments to benchmark against legal requirements and industry trends and proposes practical risk mitigation measures.

Photo of Jayne Ponder Jayne Ponder

Jayne Ponder is an associate in the firm’s Washington, DC office and a member of the Data Privacy and Cybersecurity Practice Group. Jayne’s practice focuses on a broad range of privacy, data security, and technology issues. She provides ongoing privacy and data protection…

Jayne Ponder is an associate in the firm’s Washington, DC office and a member of the Data Privacy and Cybersecurity Practice Group. Jayne’s practice focuses on a broad range of privacy, data security, and technology issues. She provides ongoing privacy and data protection counsel to companies, including on topics related to privacy policies and data practices, the California Consumer Privacy Act, and cyber and data security incident response and preparedness.

Photo of Jessica Ke Jessica Ke

Jessica Ke is an associate in the firm’s Privacy and Cybersecurity and Advertising and Consumer Protection practice groups. Jessica advises clients on a wide range of regulatory and compliance issues, including compliance with state comprehensive privacy laws, advertising substantiation issues, and participation in…

Jessica Ke is an associate in the firm’s Privacy and Cybersecurity and Advertising and Consumer Protection practice groups. Jessica advises clients on a wide range of regulatory and compliance issues, including compliance with state comprehensive privacy laws, advertising substantiation issues, and participation in the regulatory process. Jessica also maintains an active pro bono practice.