Privacy & Information Security Law Blog

On September 27, 2013, California Governor Jerry Brown signed into law a bill amending the California Online Privacy Protection Act (“CalOPPA”) to require website privacy notices to disclose how the site responds to “Do Not Track” signals, and whether third parties may collect personal information when a consumer uses the site. Although the changes to the law do not prohibit online behavioral advertising, this is the first law in the United States to impose disclosure requirements on website operators that track consumers’ online behavior.

Currently, CalOPPA requires any operator of a commercial website or online service that collects consumers’ personal information through the Internet to post a privacy policy that (1) identifies the types of personal information it collects and the categories of third-party entities with which the operator may share that information; (2) provides a description of how consumers may review or request changes to personal information collected through the website or service; (3) describes how the operator will notify consumers regarding material changes to the privacy policy; and (4) lists the policy’s effective date.

The new amendments further require that online privacy policies disclose how the website operator responds to Do Not Track signals from web browsers or “other mechanisms” that provide consumers a choice regarding the collection of personal information. This requirement may be satisfied by “providing a clear and conspicuous hyperlink in the operator’s privacy policy to an online location containing a description, including the effects, of any program or protocol the operator follows that offers the consumer that choice.” Online privacy policies also must disclose whether third parties may collect personal information about a consumer’s online activities over time and across sites when the consumer visits the website or uses the online service.

As has always been the case, under CalOPPA, operators who fail to provide the requisite disclosures will be given a warning and 30 days to comply before being deemed in violation of the law and subject to an enforcement action.

We reported last week that California Governor Brown signed into law a bill that adds “Privacy Rights for California Minors in the Digital World” to CalOPPA.

Read the full text of the new privacy policy requirements.