On July 20, 2023, the U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR) and the Federal Trade Commission (FTC) sent a joint letter to approximately 130 hospitals, telehealth providers, health app developers, and other healthcare industry companies warning of the “serious privacy and security risks” related to the use of online tracking technologies integrated into their websites and mobile apps. The FTC released a press release about the joint letter here and OCR released a press release about the joint letter here.Continue Reading OCR and FTC Issue Joint Letter to Healthcare Companies Warning About Online Tracking Technologies

New Requirements Include Identifying Specific Third Parties to Whom Businesses Disclose Data and Consent for Targeted Advertising to Teens

Texas, Oregon, and Delaware are the latest states to join the growing landscape of comprehensive data privacy laws, adding to the many state privacy laws that were passed this year.1 On June 18, 2023, Governor Greg Abbott signed the Texas Data Privacy and Security Act. On July 18, 2023, Governor Tina Kotek signed Oregon Senate Bill 619, referred to as the Oregon Consumer Privacy Act. Similarly, on June 30, 2023, the Delaware legislature passed the Delaware Personal Data Privacy Act. In doing so, Texas and Oregon officially became the 10th and 11th states, respectively, to enact a comprehensive privacy law. Assuming Governor John Carney also signs the Delaware Personal Data Privacy Act, his state would join as the 12th with that status. All three of the most recent laws are substantially similar to the prior state comprehensive consumer privacy laws, but they each include some key particularities that companies should be aware of as they plan their compliance strategies.Continue Reading Texas, Oregon, and Delaware Join the Comprehensive U.S. State Privacy Law Landscape

In a shocking turn of events, a Superior Court for the County of Sacramento issued a ruling on June 30, 2023, enjoining the enforcement of the California Privacy Protection Agency’s (the “Agency’s”) California Privacy Rights Act (CPRA) modifications to the California Consumer Privacy Act (CCPA) regulations until one year after the regulations have been finalized. We previously issued an alert reminding businesses that the CPRA amendments to the CCPA become enforceable starting July 1, 2023, but, in accordance with the court’s ruling, the Agency’s recent modifications to the CCPA regulations to account for the CPRA’s changes to the CCPA now will not become enforceable until March 29, 2024. Per the court’s ruling, the prior CCPA regulations will remain in effect until the new regulations become enforceable.Continue Reading Sacramento Superior Court Delays Enforcement of CPRA Implementing Regulations

On July 1, 2023, the Colorado Privacy Act (ColoPA) and Connecticut Data Privacy Act (CTDPA) will go into effect, joining California and Virginia, whose data privacy laws are already in effect. Notably, while the California Privacy Rights Act (CPRA) amendments to the California Consumer Privacy Act (CCPA) went into effect on January 1, 2023, those amendments will also become enforceable starting July 1, 2023. While there are a number of compliance obligations that overlap among these laws, businesses should be aware of the key obligations for ColoPA, specifically the ColoPA Rules that were finalized just a few months ago, and the CTDPA, since they may require businesses to update their privacy notices and practices. This alert provides a high-level summary of significant obligations from the ColoPA law and regulations and the CTDPA to aid companies preparing to be in compliance by the July 1st deadline.

Colorado

As covered in prior alerts,1 entities subject to ColoPA, which include the ColoPA Rules finalized on March 15, 2023, can face civil penalties of up to $20,000 per violation for noncompliance if the violation cannot be cured within 60 days. As such, businesses should go through these key takeaways to ensure they have properly considered the obligations for their companies:

  • Privacy Notice Content Requirements. Unlike the CCPA, ColoPA requires controllers to map each category of personal data collected to the controller’s specific use of that data. The ColoPA also requires controllers to notify consumers of material changes to its privacy notice, such as when the controller begins to share personal data with new categories of third parties and when a controller processes personal data for a new purpose.
  • Consent. ColoPA requires controllers to obtain opt-in consent prior to processing a variety of data, including sensitive data, personal data concerning known children, and processing personal data for new purposes (even if personal data was collected prior to July 1, 2023). The ColoPA also establishes specific requirements for how to obtain valid, informed consent.
  • Consent for Previously Collected Data, Reseeking Consent, and Refreshing Consent. Companies should also take note of the many other requirements for establishing and maintaining proper consent obligations. Most notably:
    • Controllers must refresh previously obtained consents if the consumer has not interacted with the controller in the past 24 months unless the consumer has the ability to update their opt-out preferences at any time through a user-controlled interface.
    • Controllers that do not obtain valid consent to continue processing sensitive data that was collected prior to July 1, 2023, will have until July 1, 2024, to obtain that consent.
    • Controllers can also reseek a valid form of consent from consumers if they have a “reasonable belief” that the consumer intended to opt back into the sale of personal data or processing of personal data for targeted advertising.
  • Right to Opt Out. Like the CCPA, ColoPA allows consumers to opt out of the sale of their personal data. Although consumer opt-out rights under the CCPA now extend to the “sharing” of personal data for targeted advertising purposes,2 ColoPA goes a step further and allows consumers to opt out of any use or any other processing of personal data for the purposes of targeted advertising. The ColoPA confirms that “Your Privacy Choices” (among other examples) can be a valid opt-out link text, which aligns with one of the options provided by the CCPA.
  • Data Minimization. Businesses that store personal data, including photographs, audio or voice recordings, and biometric identifiers, will need to annually assess whether such storage is necessary, adequate, or relevant for the stated processing purpose.
  • Data Protection Assessments. The ColoPA Rules require companies to conduct data protection assessments for processing activities conducted after July 1, 2023, that “present[] a heightened risk of harm” to consumers. ColoPA provides much more prescriptive guidance than the CCPA and the Virginia Consumer Data Protection Action (VCDPA) on how to conduct these assessments.

Connecticut

While we previously covered the scope and applicability of the CTDPA here, companies should be aware that just a few weeks ago, the Connecticut state legislature amended the CTDPA by creating new data privacy requirements for consumer health data and children’s personal data.3 The provisions related to processing of consumer health data will take effect on July 1, 2023, whereas other provisions related to the use and processing of children’s data will go into effect in July and October of 2024. From the period of July 1, 2023-December 31, 2024, the Connecticut Attorney General will provide companies with a notice of alleged violations and a 60-day cure period, if the attorney general determines that a cure is possible. But beginning on January 1, 2025, the attorney general will have discretion on whether to grant a controller or processor an opportunity to cure.

Companies that have already begun preparing for compliance with the laws in Colorado and Virginia will likely still require additional updates to comply with the CTDPA. Below, we summarize the major differences between these laws and the key obligations from the CTDPA passed on May 10, 2022, and as amended on June 2, 2023.

  • Expanded Definition of Sensitive Data. The CTDPA requires controllers to obtain consent before processing sensitive data, consistent with the VCDPA and ColoPA. As amended, the CTDPA’s definition of “sensitive data” is expanded to include “consumer health data”4 and “data concerning an individual’s status as a victim of a crime.”
  • Right to Opt Out. Like Colorado and Virginia, Connecticut residents will have the right to opt out of personal data sales, targeted advertising, and profiling. Notably, however, the CTDPA does not require that opt-outs be authenticated like ColoPA.
  • New Prohibitions on the Disclosure of Consumer Health Data. As amended, the CTDPA adds a new section outlining specific requirements related to consumer health data, including prohibiting persons from: 1) providing employees or contractors with consumer health data unless they are subject to a contractual or statutory duty of confidentiality; 2) using geofences within 1,750 feet of mental, reproductive, and sexual health facilities “for the purpose of identifying, tracking, collecting data from or sending any notification to a consumer regarding the consumer’s consumer health data”; and 3) selling consumer health data without first obtaining consumer consent.

Businesses should not delay in addressing some or all of these new obligations until July 1. Companies that updated their notice and practices for January 2023, when the CPRA and VCPDA went into effect, with the aim to be compliant throughout 2023 will almost certainly need to address the many developments since then and should revisit their compliance practices.

Wilson Sonsini Goodrich & Rosati routinely helps companies navigate complex privacy and data security issues. For more information or advice concerning your CCPA, ColoPA, and CTDPA compliance efforts, please contact Maneesha MithalTracy ShapiroEddie HolmanStacy Okoro, or any member of the firm’s privacy and cybersecurity practice.


[1] We previously covered the Colorado AG’s rulemaking process and pre-rulemaking considerations in the following Wilson Sonsini Alerts: “Colorado AG’s Office Announces Final Colorado Privacy Act Rules: Key Takeaways,” “Colorado Attorney General’s Office Releases Third Version of Draft Rules for Colorado Privacy Act: Key Takeaways,” “Colorado Attorney General’s Office Releases Modified Draft Rules for Colorado Privacy Act: Key Takeaways,” “Colorado Attorney General Announces Privacy Rulemaking,” and “Colorado Attorney General Issues Pre-Rulemaking Considerations for the Colorado Privacy Act.” We also provided an overview of the ColoPA’s key requirements in another Wilson Sonsini Alert, “Colorado Becomes Third State to Pass New General Privacy Law.”

[2]Referred to as “cross-context behavioral advertising” in the CCPA.

[3]See passed Senate Bill 3 (enacted on June 2, 2023).

[4]Defines “consumer health data” as “any personal data that a controller uses to identify a consumer’s physical or mental health condition or diagnosis, and includes, but is not limited to, gender-affirming health data and reproductive or sexual health data.”Continue Reading Are You Ready for the 3Cs?: California, Colorado, and Connecticut’s New Privacy Laws Become Enforceable July 1, 2023

On March 2, 2023, the Federal Trade Commission (FTC) announced a proposed settlement agreement (also referred to as “proposed consent order”) with BetterHelp, Inc., an online counseling service, for allegedly disclosing its website visitors’ and

Continue Reading FTC Announces Settlement with BetterHelp for Disclosing Consumers’ Health Information to Third-Party Advertisers

On February 1, 2023, the Federal Trade Commission (FTC) announced a complaint against and proposed settlement agreement (the “proposed order”) with GoodRx, a digital health company, over its data sharing practices that allegedly

Continue Reading FTC Announces First Enforcement Action Under the Health Breach Notification Rule Against GoodRx

On January 27, 2023, the Colorado Attorney General’s (Colorado AG) office released the third version of its proposed draft rules (third draft) for the Colorado Privacy Act (ColoPA) based on public comments it received on

Continue Reading Colorado Attorney General’s Office Releases Third Version of Draft Rules for Colorado Privacy Act: Key Takeaways