California Pushes Companies to Bolster Data Sharing Opt Outs

California has ramped up fining companies that don’t make it easy for consumers to object to the sharing of their personal data.

Back-to-back enforcement actions from the California Privacy Protection Agency solidified the regulator’s expectations for how companies should let users opt out of the selling or sharing of their personal information. The spike in enforcement comes amid a broader focus on opt outs from regulators across the country, with looming investigations from Colorado and Connecticut.

The agency last week scrutinized how Ford Motor Co. and PlayOn Sports, a media and tech company used in high school sports and events, executed consumers’ opt-out requests—a right from the California Consumer Privacy Act that CalPrivacy had also focused on when levying fines against retailer Todd Snyder Inc. and American Honda Motor Co. last year.

Despite recognizing Ford’s unintentional violation of the state’s privacy law and PlayOn’s efforts to proactively fix its issues, the agency issued a combined $1.5 million in fines in a matter of days, revealing its interpretation of the opt-out options companies must give to consumers.

“The major takeaways for me were, again, this trend of, ‘We’re not going to accept this optics compliance theater anymore,’” said Ron De Jesus, field chief privacy officer at Transcend, a privacy compliance vendor. He added that companies are increasingly expected to make sure opt outs work across platforms.

Getting Opt Out Right

California requires companies to give consumers at least two methods to opt out of the sale and sharing of their data, noting that one of the options should match the manner in which a business primarily interacts with its consumers.

The agency raised the expectations for what these options should look like with the settlements, said Usama Kahf, California-based partner at Fisher Phillips LLP and co-chair of the firm’s privacy and cyber practice group.

“We can essentially create a rule based on this enforcement action,” he said. “The implied rule is that if you use digital tracking technology, you have to have a digital opt-out method—meaning you have to be able to click on a button to opt out of the collection of data through cookies and pixels, which is not what’s in the regulation.”

CalPrivacy found the toll-free phone number and email address PlayOn gave consumers to object to the sale or sharing of their personal information insufficient.

“I think the regulator is looking at it from the mindset of regular consumer interactions with your product or service, and not really hiding behind the technicalities of what the CCPA might say,” De Jesus said.

The agency is also focusing its enforcement on companies that make consumers go through unnecessary steps before processing their requests. CalPrivacy found Ford’s requirement for consumers to confirm their identity before it’d process their requests to opt out of the sale or sharing of their personal information violated the state’s privacy law.

More to Come

Giving consumers a user-friendly method to object to the disclosure of their data is a priority for several regulators. California’s attorney general, who also enforces the state’s privacy statute, issued a record fine against Walt Disney Co. last month over the company’s failure to honor consumers’ opt-out requests throughout Disney’s services and devices.

Connecticut and Colorado are also investigating companies’ compliance with browser settings that allow users to opt out of the sharing of their personal information.

“These are not new issues; these are just issues that have not been enforced as much in the past as they are right now. And one of the reasons is that it’s an easy check at this point,” said Daniel Meyerson, fractional chief privacy officer. Most regulators can now “go through the process and check to see if the website honors the global privacy controls.”

And CalPrivacy’s work regarding opt outs may just be beginning. On March 6, the agency started collecting preliminary feedback on whether it should change its regulations or if new rules are needed for consumers to more easily exercise their privacy rights.

The agency asked about what challenges businesses face when processing opt-out preference signals, which let consumers broadcast a “do not sell” signal across every website they visit, and whether they need additional guidance. CalPrivacy will collect initial input through April 6 and may hold a formal public comment period if it decides to pursue new rulemaking.

“The lessons from all these enforcement actions often is you got to have someone on the wheel. You have to have someone driving this bus that knows what to do, and most companies don’t,” Kahf said. “They just go to a consultant or a law firm, and they do it once, build their program and then forget about it—then things go south.”