This summer, Colorado passed the new data privacy law called the Colorado Privacy Act (“CPA”), granting Colorado residents new rights and creating new obligations for businesses that are located in or conduct business with those in Colorado. CPA regulates the collection of personal data, or information relating or reasonably linkable to an identifiable person, such as a person’s name, social security numbers, email address, transaction data, Internet browsing history, and geolocation.
Continue Reading Colorado Privacy Act

In April, Rob Bonta became the new California Attorney General. In swift form, and not taking any summer break, he has made it clear that privacy and CCPA compliance is a priority, and that enforcement won’t be limited to a handful of requirements under the CCPA, as many previously believed.

First, the Attorney General posted several examples of enforcement actions, including those addressing the following issues:
Continue Reading The Summer of CCPA Enforcement

With COVID-19 driving so much business online, like most people, I am increasingly seeing offers from companies vying for new customers to hand over my contact information in exchange for discounts or rewards. This includes businesses that seek to use personal information obtained through loyalty or rewards programs, those that offer price or service differences such as with free versus paid subscriptions to a service (e.g., music streaming), or those that simply want to increase their marketing reach and attract new consumers by offering a discount in exchange for personal information. There is really nothing new to these types of marketing strategies, but for companies that are subject to the California Consumer Privacy Act (CCPA), providing discounts, rewards or free-versus-paid services to California consumers has become trickier because the CCPA contains very specific – and quite stringent – obligations when it comes to financial incentives. The CCPA defines a “financial incentive” as a program, benefit, or other offering (including payments to consumers) related to the collection, retention, or sale of personal information – or, put simply, you give me your personal information and I will give you a discount code or rewards. Many businesses that are subject to CCPA, however, are not complying with the CCPA’s complex requirements regarding financial incentives. Failing to comply could spell trouble. Below we explain the challenges of implementing the CCPA’s requirements with respect to financial incentives.
Continue Reading Providing Financial Incentives Under CCPA

During a recent keynote presentation with the IAPP following the July 1 enforcement deadline of the CCPA, Stacey Schesser, Supervising Deputy Attorney General for the State of California (“Deputy AG”), provided a bit of a roadmap for CCPA enforcement actions from the California Attorney General (“AG”) that are both currently underway and expected in the near future.
Continue Reading CCPA Enforcement: What to Expect Next

The California Attorney General’s final proposed regulations under CCPA (“Regulations”) have been submitted, and pending approval by the California Office of Administrative Law, will soon become enforceable by law. One often overlooked requirement of the CCPA is the obligation of covered businesses to provide notices that are “reasonably accessible.” All drafts of the Regulations have provided more detail about the accessibility requirement contained in the CCPA, and the final Regulations make clear that for notices provided online, businesses must follow generally recognized industry standards, such as the Web Content Accessibility Guidelines, version 2.1 (WCAG) from the World Wide Web Consortium. While companies have largely focused on updating the language or substance of their notices to comply with CCPA, this requirement as to form has, by and large, slipped through the cracks, but is certain to generate some discussion (if not litigation) in coming months.

By way of background, the Americans with Disabilities Act (ADA) requires, among other things, that places of “public accommodation” remove barriers to access for individuals with disabilities. While this has long been considered the rule for physical establishments, including privately-owned, leased or operated facilities like hotels, restaurants, retail merchants, health clubs, sports stadiums, movie theaters, and so on, virtual accessibility has been much less consistent, and generally the exception rather than the norm. In fact, web accessibility hardly ever appears on businesses’ radars, due perhaps to a very short-sighted perception of what, in fact, qualifies as a disability as well as a lack of overall guidance.

Web accessibility means ensuring that websites, mobile applications, and other virtual platforms can be used by everyone, including those with disabilities, such as impaired vision. However, what exactly is required is a source of confusion. In 2019, the Department of Justice (DOJ), which is responsible for establishing regulations pursuant to the ADA, withdrew regulations that had been drafted for website accessibility, and has since yet to promulgate any such regulations. This has left courts with the task of determining how and to what extent web accessibility is required under the ADA when it comes to businesses that offer goods and services online, with varying results.
Continue Reading CCPA and Web Accessibility

As if businesses did not already have enough to address with the COVID-19 pandemic and compliance with the California Consumer Privacy Act (the “CCPA”), businesses need to consider the California Privacy Rights Act (the “CPRA”), which will almost certainly be on the November ballot. Structured as an amendment to the CCPA and also known as “CCPA 2.0”, the CPRA ballot initiative was spawned by Alastair Mactaggart. You may recall Mr. Mactaggart as the real estate developer who submitted a ballot initiative that resulted in a negotiation with the state legislature to replace the initiative with the CCPA. If the CPRA is passed and becomes law, it would be effective and enforceable January 1, 2023, with certain provisions having a look-back provision.

The CPRA would establish a new category of “sensitive data” that is reminiscent of the GDPR’s definition of special categories of data but it is much broader. The definition is overly-inclusive, spanning from race, religion, and sexual orientation to financial account information and government identifiers (e.g., social security numbers). Consumers could choose to limit the use, sale and sharing of their sensitive data. Additional links on business websites may be required to “Limit the Use of My Sensitive Personal Information” in addition to the current “Do Not Sell My Personal Information” link that some businesses must now include under the CCPA.
Continue Reading The California Privacy Rights Act: CCPA Part Two

As cities and states gradually open up, companies have begun to assess under what circumstances they can re-open the workplace – and in particular, what health-related personal information can and should be collected. When it comes to monitoring employees, generally speaking, privacy and employment law are increasingly overlapping as more stringent laws are adopted, and COVID-19 has brought this overlap to the forefront. Our employment team at Hopkins & Carley has provided a number of resources and webinars on the employment-related issues of COVID-19 and what can and cannot be done (available here). Here we will focus on the intertwined privacy implications of allowing individuals – employees and non-employees – back into offices and facilities, particularly with respect to the California Consumer Privacy Act (CCPA).

What are the CCPA’s notice requirements?
Continue Reading Returning to Work: CCPA Considerations

The California Consumer Privacy Act (CCPA) goes live in six weeks. While many companies have been working on mapping their data for some time, others are just getting started. Some of the issues left open by the language of the CCPA and the proposed regulations have yet to be resolved, but there is no question

As part of our blog series, we share some of the most frequently asked questions that we receive from organizations across different industries regarding data privacy and security, and more specifically GDPR and CCPA. This is the second FAQ in our series.


Even though the California Consumer Privacy Act (“CCPA”) will be effective January 1, 2020, the time to plan for compliance is now.  It may seem as though you have plenty of time to prepare but it is a mistake to not start preparing. Indeed with the twelve-month lookback provisions, companies must have proper records of personal information that they collected as of January 1, 2019.

Under the CCPA, individuals have various new rights that must be detailed in a company’s just in time privacy notice (a new requirement under the Attorney General’s proposed regulations) and a company’s privacy policy, including the right to access their information, to request deletion of their information, to be informed of certain transfers of their information, to opt-out (if over 16) of or opt-in (if under 16) to sales of their information, and receive equal service and price even if they exercise their rights.

There are many nuanced questions to consider that may not be apparent on a cursory read of the CCPA or the proposed Attorney General regulations. Some basic common questions arise when companies first hear about the CCPA, as follows.
Continue Reading Privacy FAQ #2 – CCPA

Similar to the months before the GDPR went into effect at the end of May 2018, companies are now actively preparing for compliance with the California Consumer Privacy Act (CCPA).  As California leads the pack of states in terms of privacy and technology laws, other states have followed suit, including Nevada.

The Nevada statute (SB 220) is an amendment to Nevada’s existing law, which requires website operators to have a privacy policy with certain disclosures.
Continue Reading From the Golden State to the Silver State – Privacy Law in Nevada