By Ashley Kenney Shea
Special to the Legal
Businesses need to examine their privacy practices as we head into the new year. California, which has emerged over the years as a leader when it comes to online privacy, recently enacted new legislation that applies to all businesses that collect any personally identifiable information (PII) about California residents on the Web and/or by mobile app. Practically speaking, this means that the law applies to any U.S. business that operates a commercial website or app and collects as little as first and last names.
The new law, which is an amendment to the California Online Privacy Protection Act (CalOPPA), requires that privacy policies now include whether and how a business’ website responds to a Web browser’s do-not-track signal and whether the business allows third parties to collect PII about users over time and across different websites. The enactment is set to become effective Jan. 1, 2014, with fines of up to $2,500 for those businesses that fail to comply. Each download of a mobile app will constitute a violation, according to the California attorney general. Before any fine is imposed, however, businesses will be warned and given 30 days to become compliant.
CalOPPA already obligates a business that collects PII to conspicuously post a privacy policy describing the categories of PII that it collects, with whom it shares that information, and how it will notify consumers of changes to the policy.
Commentators on the new amendment have said that the impetus dates back to 2011, when Mozilla offered the do-not-track feature for Firefox, enabling users to indicate that they did not want websites tracking their Internet surfing in order to serve targeted advertising. Other providers like Google and Apple adopted the feature, but all along there has been no requirement that websites honor such requests under the law, nor is there any requirement that websites let users know that they do not honor such requests. The amendment falls short of requiring websites to honor do-not-track requests, but it does put pressure on websites to do so since their policy must now be announced to users. Further, websites that claim to honor do-not-track requests, and then do not, may be penalized by the Federal Trade Commission.
Before the start of 2014, businesses would be well advised to verify what, if any, tracking services they use and how they respond to do-not-track settings. They should also determine whether third parties, such as advertisers on their site, track users through the use of cookies or other functionality. Finally, the privacy policy should be updated to clearly communicate these elements to visitors of the site.
For more information, please contact Dina Leytes ([email protected] or 215-732-3924), Kathryn Goldstein Legge ([email protected] or 215-618-3722) or Ashley Kenney Shea ([email protected] or215-501-7843).
Comments