Privacy

Subscribe to Privacy via RSS

On August 24, 2022, the California Attorney General (AG) announced the entry of a final judgment to resolve claims that makeup retailer Sephora violated the California Consumer Privacy Act (CCPA). Notably, this is the California AG’s first enforcement action resulting in a fine and settlement under the CCPA. The California AG alleged that Sephora violated the CCPA by failing to disclose that it was selling the personal information of California consumers through the use of third-party website advertising and analytics tools, failing to provide a “Do Not Sell My Personal Information” link for consumers to opt out of those sales, and failing to honor Global Privacy Control (GPC) signals as a means of opting out. As part of the relief, Sephora was ordered to pay a $1.2 million penalty and, among other things, implement a monitoring and reporting program to demonstrate its ongoing compliance with the CCPA.
Continue Reading California Attorney General Settles First-Ever CCPA Enforcement Action

On August 11, 2022, the Federal Trade Commission (FTC) took the first step toward creating national privacy and security rules that, if finalized, would apply across most sectors of the U.S. economy. The agency unveiled an Advance Notice of Proposed Rulemaking (ANPRM), which asks for public comment on 95 questions, ranging from topics such as targeted advertising, security of personal information, algorithmic discrimination, and protection of children and teens. Comments are due within 60 days of publication of the ANPRM in the Federal Register. The ANPRM was issued with a 3-2 vote along party lines. This alert attempts to answer some key questions about the announcement.
Continue Reading The FTC Privacy Rulemaking: What’s Next?

On June 24, 2022, the United States Supreme Court issued its decision in Dobbs v. Jackson Women’s Health Organization,1 opening a legal path to state laws restricting or prohibiting access to certain reproductive health services. To enforce these laws, law enforcement officials may attempt to access individuals’ health information, including from technology platforms that process health information on behalf of individuals or other businesses.
Continue Reading Privacy Post-Dobbs: Recent Guidance from U.S. Regulators

On July 18, 2022, the long-awaited Digital Markets Act (DMA) received the final approval of the EU’s co-legislators. The DMA will impose stringent far-reaching obligations on the largest digital platforms: the “gatekeepers.” The regulation will give the European Commission (EC) significant new enforcement powers, including the ability to impose severe fines and remedies in case of non-compliance.

The DMA will profoundly change the way in which big tech platforms operate in the EU. It will capture the largest tech companies and potentially 15-20 other platforms such as Alibaba and Booking.com. It will also create complications for non-gatekeepers, as the rules will impact how data can be shared with a gatekeeper’s commercial partners.
Continue Reading D(MA)-Day: Formal Adoption of the EU Digital Markets Act

On July 18, 2022, the EU Council formally adopted the EU Digital Markets Act (DMA), following approval by the EU Parliament earlier this month (the press releases are available here and here). The final DMA text as approved is available here.

As next steps, the final text of the law will be signed by the Parliament and Council Presidents and will be published in the EU Official Journal. The Publications Office still needs to make some further technical edits to the text before it can be published, including to clarify the date of application (i.e., add a specific date, given that the text currently states “[6 months after entry into force]”). We expect that final publication in the EU Official Journal will take place this fall.
Continue Reading EU Parliament and EU Council Approve the DMA