On February 21st, the California Attorney General (AG) Rob Bonta announced a settlement with DoorDash for violations of the California Consumer Privacy Act (CCPA) and the California Online Privacy Protection Act (CalOPPA) relating to its participation in a marketing co-operative.  This action represents only the second public enforcement action since the CCPA went into effect in 2020.

According to the complaint and settlement, DoorDash participated in a marketing co-operative, as part of which unrelated businesses contribute personal information of their customers for the purpose of advertising their own products to customers from other participating businesses.  According to AG Bonta, this was an exchange of personal information for the benefit of DoorDash and therefore a “sale” under the CCPA.  As a sale, DoorDash was required under California law to provide notice of the sale as well as the opportunity to opt out of the sale.  AG Bonta alleged that DoorDash failed to provide the necessary notice and opt-out rights. 

While the participation in such a market co-operative is largely recognized as a sale under the CCPA at this point, the enforcement action is notable for a couple reasons.  First, the complaint takes positions that arguably require disclosures in privacy policies that go beyond the plain language of the regulations.  So, even for companies that feel confident that they comply with the regulations, it would be wise to assess their policies in light of the allegations.  

Second, the conduct at issue occurred in 2020 and 2021.  While the complaint notes that DoorDash did not cure when provided with a notice of violation in 2020, AG Bonta states in his press release that “The CCPA has been in effect for over four years now, and businesses must comply with this important law.  Violations cannot be cured, and my office will hold businesses accountable if they sell data without protecting consumers’ rights.”  

There are many lessons to learn from this action, but perhaps the most important is that businesses should prepare for what may be an increasingly aggressive enforcement policy without the opportunity to cure.  To do so, businesses should not only assess where they have gaps and how they can close those gaps, but also what can be done to best position for any arguments about past non-compliance.  

[View source.]