California State Attorney General Rob Bonta announced a new investigative sweep focusing on streaming services' compliance with the opt-out requirements under the California Consumer Privacy Act (CCPA). Specifically, the CCPA requires businesses that "sell" personal information or "share" it for targeted advertising must offer consumers the right to opt-out. Notably, assessing what is considered a "sale" or "sharing" can be complex, particularly given the broad definitions under the CCPA.
The investigation into streaming services represents the latest step in Attorney General Bonta's broader mission to have California lead the way in privacy enforcement. Over the past two years, Attorney General Bonta has initiated a wave of similar sweeps, focusing on topics including employers' use of human resources-related data, mobile applications, and loyalty programs. Across these sweeps, the Attorney General has prioritized privacy concerns in contexts that resonate with a broad spectrum of consumers.
The focus on streaming services appears to be a direct reaction to the integral role they now play in modern entertainment consumption and the extent of personal data collection, use, and disclosure on streaming platforms that may be surprising to consumers. In the announcement, Attorney General Bonta explains, “From watching live sporting events to blockbuster movies, families increasingly use streaming platforms for entertainment, and we must make sure that their personal information is protected."
Attorney General Bonta's insistence on the ease and accessibility of the opt-out process intends to be emphasized through letters of non-compliance to businesses considered lacking in CCPA obligations. Companies that fall under the purview of the CCPA are tasked with distinct obligations, such as offering prescribed means to opt-out, promptly addressing consumer requests to exercise their rights, and providing consumers with informative notices explaining their privacy practices.
Beyond the immediate impact of the CCPA investigation, Attorney General Bonta's actions signal a broader shift toward regulatory scrutiny in the digital landscape and proactive review of organizations' compliance efforts. He has already spearheaded two enforcement settlements, resulting in a US$1.2 million penalty against Sephora and a US$375,000 penalty against DoorDash for failing to comply with the CCPA's sales requirements. In addition to significant monetary penalties, Attorney General Bonta has sought extensive injunctive relief, including requiring Sephora and DoorDash to develop and report on updated compliance programs. The CCPA allows for injunctive relief and monetary penalties of up to US$7,500 per intentional violation and US$2,500 for other violations (with a single violation likely calculated on a granular, per consumer, per data collection level).
State Attorneys General are ascendent and are actively pursuing industry-wide actions to enforce compliance. It is more imperative than ever for companies operating on a large scale and under public scrutiny to be proactive concerning state internal compliance and investigatory efforts. This most recent enforcement focus on streaming services could mean more significant impacts to businesses in the sports, media, and entertainment sector.
Annually recognized as the legal market leader for this sector and in privacy and cybersecurity, our Hogan Lovells team proactively advises streaming services clients on CCPA compliance issues. We leverage this practice with our rapidly emerging top State AG practice led by the former and first-elected Attorney General of the District of Columbia and former President of the National Association of Attorneys General (NAAG).
