The first line of California’s Constitution (after the Preamble) establishes that “All people are by nature free and independent and have inalienable rights...[including] privacy.”
Effective since July 1, 2004, California Business and Professions Code §§ 22575-22579 require that commercial entities on the Internet who collect California-based users’ “personally identifiable information” post a conspicuous privacy policy, which must contain several clauses.
Under BPC §22577(a), “personally identifiable information” includes:
Under BPC §22577(b), the privacy policy must be “reasonably accessible,” including:
Under Under BPC §22575(b), the privacy policy must:
The CCPA’s legislative findings indicate that California’s Constitutional Privacy right (supra) includes “the ability of individuals to control the use, including the sale, of their personal information.” Thus the Act not only further regulates users’ right to disclosure by online entities who collect and trade their personal data, it grants users the right to request their data not be sold and even the affirmative right to have it deleted upon request.
The CCPA applies to business entities of all types (including subsidiaries) that:
“Personal information” means information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal information includes, but is not limited to, the following:
Notably, “personal information” does not include publicly available information.
The CCPA grants online users “The right to request that a business delete any personal information about the consumer which the business has collected from the consumer.” Cal. Civ. Code § 1798.105(a).
Moreover, sub (b) and (c) of § 1798.105(b) provide that the online entity must:
There are exceptions. An online entity can keep the data if it’s “necessary” to:
Generally
Whether or not the sharing of user data with advertisers or other third parties will be “reasonably anticipated within the context of a business’s ongoing business relationship with the consumer” is likely to be hotly contested. But in any case, the CCPA grants users an opt-out: “[Users have t]he right, at any time, to direct a business that sells personal information about the consumer to third parties not to sell the consumer’s personal information.”
“Do Not Sell My Personal Information” Disclosure
Businesses are required to provide information explaining and facilitating the opt-out:
After the user’s opt-out, businesses must refrain from contacting a user for 12 months before again requesting that the user authorize the sale of their personal information.
Personal Data of Minors and Opt-In
As a catch-all, online entities with knowledge of users’ ages are prohibited from selling the personal information of individuals less than 16 years of age.
However, users less than 16 years of age can opt-in to the sale of their personal information upon consent of:
No Discrimination Against Users For Exercising CCPA Rights
In order to preserve its impact, the CCPA prohibits businesses from discriminating against users who exercise their rights under the Act. This includes:
However, businesses can offer differential prices, rates, levels and quality if the difference is “reasonably related to the value provided to the consumer by the consumer’s data.”
Users’ Financial Interest In Their Personal Data
Perhaps most intriguing about the CCPA is its formalization of a market for personal data by granting users a pecuniary interest in their own personal data.
Businesses can offer financial incentives, including payments to consumers, for the collection, sale or deletion of personal information, provided:
The CCPA imposes broad and detailed disclosure requirements on Internet entities that collect users’ personal data, far exceeding the extent offered by previous California law.
Prior to any collection of personal data, the Act requires the online entity to disclose:
Moreover, users can request that covered businesses disclose:
In response to such a user request, the online entity must disclose the info, inter alia:
As stated supra, businesses must provide disclosures explaining and facilitating the opt-out by consumers from the sale of their personal information:
Online businesses engaged in a “single, one-time transaction” are not required to retain personal data if they: Do not sell it; or Link to it “in a manner that would be considered personal information.”
Online businesses that reveal users’ personal information for a “business purpose” (an operational purpose of the businesses reliant upon that information) must disclose those business purposes upon request by a user. Such purposes may include:
In order to comply with the Act, online entities that collect personal data must provide and notify users of at least two methods for submitting disclosure requests, including: A toll-free phone number; and An Internet Web site.
The business’s Privacy Policy must disclose all of the users’ rights:
The policy’s information must be updated at least once every 12 months.
The Act can be enforced both publicly and privately.
The California AG can enforce the CPAA:
Private Cause of Action
The CPAA provides private actors (including class plaintiffs) with an action to seek:
AG Notification: The user / plaintiff must notify the Attorney General 30 days after filing the action, after which the AG can:
Many California cases involving an online “Privacy Policy” depend on enforceability (particularly arbitration and forum selection clauses), and the court’s determination of whether a user’s Website use constituted agreement to the privacy policy.
The analysis court’s analysis often involves the distinction between
“Browsewrap” - wherein links to the Privacy Policy are available but a user is not required to “click” on them in order to use the site; or
“Clickwrap” - wherein the user is prevented from using the site until affirmatively “clicking” on an acknowledgement that the Privacy Policy applies and is available for review.
Notably, a user need not have actual notice of the Policy (i.e., need not have in fact clicked or read the policy); constructive notice of its existence and availability is often sufficient.
“There is evidence that prior to completing payment at the time plaintiffs booked their vacation on defendant’s website the final booking screen required the user to review a check list that expressly included a requirement that the user acknowledge he or she read and accepted the Rules and Restrictions, Terms of Use and privacy policy; and there were imbedded hyperlinks to allow full review of the terms of use and privacy policy that were in a different color than the other text on that final booking screen. (See Declaration of Pinglang Wang in Support of Motion, paragraphs 3 and 4; and Exhibit A.) The hyperlinks were not hidden. In fact, they were highlighted in blue in the sentence on the final booking screen that stated: “By selecting to complete this booking I acknowledge that I have read and accept the above Rules & Restrictions, Terms of Use and Privacy Policy.” The “COMPLETE BOOKING” button is below that sentence...The court finds that the agreement was an enforceable clickwrap agreement.” Beland v. Expedia, Inc. PC-20160434 (8/10/2017) (https://trellis.law/ruling/PC-20160434/beland-v-expedia-inc/201708103830f6).
“It is undisputed that Plaintiff created an account to use Uber services in October 2015, and that Plaintiff had to register. After entering account information and payment information, Plaintiff had to click a “Register” button as the last step. Underneath the Register button was the statement: “By creating an Uber account, you agree to our Terms & Conditions and Privacy Policy,” with the Terms and Conditions and Privacy Policy (“T&C”) being hyperlinked. (Declaration of Jose Diepa, Exh. A.) Contained within the T&C was an arbitration agreement stating that any dispute, claim or controversy arising out of relating to the T&C or the breach, termination, enforcement, interpretation or validity thereof or the use the Services would be settled by binding arbitration…
“At issue is whether the hybrid “clickwrap” and “browsewrap” agreement on Uber’s application was sufficient to put Plaintiff on inquiry notice of the terms of the contract. The agreement here was neither strictly clickwrap nor strictly browsewrap. Based on the screenshots submitted by Uber, Plaintiff was required to click a “Register” button in order to create his account and use Uber services. Below the “Register” button was the sentence: “By creating an Uber account, you agree to our Terms & Conditions and Privacy Policy” and the T&C was hyperlinked. This sentence would put a reasonably prudent person on notice that clicking the “Register” button communicated assent to the T&C.” Shayan Fadaee vs. Uber Technologies, Inc. Et Al, BC681145 (4/19/2018) (https://trellis.law/ruling/BC681145/shayan-fadaee-vs-uber-technologies-inc-et-al/20180419261416).
“However, at issue is whether the hybrid “clickwrap” and “browsewrap” agreement on HomeAway’s website was sufficient to put Kathryn on inquiry notice of the terms of the contract. The Court concludes that HomeAway has met its burden of showing a valid arbitration agreement exists. The agreement here was neither strictly clickwrap nor strictly browsewrap. Based on the screenshots provided by HomeAway, Kathryn was required to click a “Continue” button in order to confirm her reservation. Directly above the “Continue” button was the sentence: “By clicking ‘Continue’ you are agreeing to our Terms and Conditions and Privacy Policy” and the T&C was hyperlinked. This sentence would put a reasonably prudent person on notice that clicking the “Continue” button communicated assent to the T&C.” Kathryn Gurley Et Al vs. Mario Gandelsonas Et Al, BC663217 (2/6/2018) (https://trellis.law/ruling/BC663217/kathryn-gurley-et-al-vs-mario-gandelsonas-et-al/20180206513642).
“The Terms of Use here are of the “browsewrap” variety. A browsewrap agreement does not require a user to actually click on the terms to confirm his/her assent, unlike what is known as a “clickwrap” agreement. As one court has explained: Unlike a clickwrap agreement, a browsewrap agreement does not require the user to manifest assent to the terms and conditions expressly ... [a] party instead gives his assent simply by using the Web site...’ [Citation.] Indeed, ‘in a pure-form browsewrap agreement, “the Web site will contain a notice that—by merely using the services of, obtaining information from, or initiating applications within the Web site—the user is agreeing to and is bound by the site's terms of service.” ’ [Citation.] Thus, ‘by visiting the Web site—something that the user has already done—the user agrees to the Terms of Use not listed on the site itself but available only by clicking a hyperlink.’ [Citation.] ‘The defining feature of browsewrap agreements is that the user can continue to use the Web site or its services without visiting the page hosting the browsewrap agreement or even knowing that such a Web page exists.’ [Citation.] ‘Because no affirmative action is required by the Web site user to agree to the terms of a contract other than his or her use of the Web site, the determination of the validity of the browsewrap contract depends on whether the user has actual or constructive knowledge of a Web site's terms and conditions. Nguyen v. Barnes & Noble, Inc. (9th Cir. 2014) 763 F. 3d 1171, 1176 (“Nguyen”). Here, it is undisputed that in order for Plaintiff Laura Thompson to purchase the concert tickets, she was required to acknowledge the Terms of Use at least twice. Thus, when she created her account (which every user must do to make a purchase), she accessed the ‘Create My Account‘ page, which contains the statement, immediately above the button to ‘Sign Up’: “By submitting, you agree to our Terms and Purchase Policy, and understand your information will be used as described in our Privacy Policy…’ The words/phrases, ‘Terms,‘ ‘Purchase Policy,‘ and ‘Privacy Policy‘ are in blue text, different from the other parts of the sentence. After creating an account, each time that a user goes on Ticketmaster’s website to access their account, a welcome/sign-in screen appears, which, similar to the others, states: ‘By continuing past this page, you agree to our Terms of Use.‘ Finally, a user of the website is not able to complete a purchase without encountering a screen that states: ‘By clicking ‘Place Order‘, you agree to our Terms of Use,‘ with ‘Terms of Use,‘ again in blue, different from the rest of the text. Contained within those Terms of Use are the following provisions regarding arbitration: Disputes, Including Mandatory Arbitration and Class Action Waiver Any dispute or claim relating In any way to your use of the Site, or to products or services sold or distributed by us or through us, will be resolved by binding arbitration rather than in court…’
“As evidenced above, the “browsewrap” agreement at issue does not require a user to actually click on the Terms of Use to confirm his/her assent, unlike what would occur with a “clickwrap” agreement. (See Long v. Provide Commerce, Inc. (2016) 245 Cal.App.4th 855, 858.) Rather, assent is inferred by the use of the website; thus, ‘the determination of whether a binding browsewrap agreement has been formed depends on whether the user had actual or constructive knowledge of the Web site's terms and conditions…’ As to actual notice, Plaintiffs argue, convincingly, that they did not read the Terms of Use and were not aware of the arbitration language. Accordingly, the key issue is whether there was constructive notice. The standard for constructive notice is whether the Terms of Use were sufficiently conspicuous to have put a reasonably prudent internet user on notice of Ticketmasters’ terms. (See Long v. Provide Commerce, Inc. (2016) 245 Cal.App.4th 855, 863 (‘we must decide whether the design of the ProFlowers.com Web site and/or the conspicuousness of the hyperlinks to the Terms of Use were sufficient to put a reasonably prudent Internet consumer on inquiry notice of the browsewrap agreement's existence and contents.’).) Here, there is language advising the user that by clicking the buttons to create and access his/her account and purchase tickets, the user agrees to the Terms of Use. Further, in each part of the account setup and ticket-purchasing process, the link to the Terms of Use is present in a different color text setting it apart from the rest of the text. While the font is not particularly large, it is not so small that it is buried on the page. ‘Where the website contains an explicit textual notice that continued use will act as a manifestation of the user's intent to be bound,’ courts are generally amenable to enforcing browsewrap agreements. Nguyen, supra, p. 1177. The court in Long v. Provide Commerce, Inc., supra at 867, confirmed this principle: “to establish the enforceability of a browsewrap agreement, a textual notice should be required to advise consumers that continued use of a Web site will constitute the consumer's agreement to be bound by the Web site's terms of use.’ Defendant required users, including Mrs. Thompson, to affirmatively agree to the Terms of Use no less than twice every time a user would log in to his/her account to purchase tickets. By purchasing the tickets through the website, she was on constructive notice of those Terms.” Thompson Vs. Live Nation Entertainment, Inc., 30-2018-00976153-CU-BT-CXC (5/4/2018) (https://trellis.law/ruling/30-2018-00976153-CU-BT-CXC/thompson-vs-live-nation-entertainment-inc/2018050445e7b4).
“In addition, the reply papers contain Mr. Chen's supplemental declaration, in which he explains the manner in which Plaintiff assented via a check box during the application process. His declaration includes a screenshot, and he states that the "Services Agreement, Terms of Service, and Privacy Policy are hyperlinked to this page next to the check box, as indicated on this screen shot by their appearing in blue text.
“This is sufficient evidence that Plaintiff assented to the terms of the "Service Agreement," which include the arbitration provision. The hyperlink was conspicuously placed directly adjacent to the acknowledgment check box, and highlighted in blue. Thus, Defendant presents sufficient evidence of the existence of a valid arbitration agreement.” De Moya Vs Rev.Com Inc, 37-2018-00041472-CU-OE-CTL (1/3/2019) (https://trellis.law/ruling/37-2018-00041472-CU-OE-CTL/de-moya-vs-revcom-inc/2019010322a287).
“Defendant argues that a demurrer should be sustained as to Plaintiff’s claim because Defendant complied with § 1978.83(c)(2) by adopting and disclosing “a policy of not disclosing personal information of customers to third parties for the third parties’ direct marketing purposes unless the customer first affirmatively agrees to that disclosure.” CC § 1798.83(c)(2).
“Defendant’s privacy policy is attached as Exhibit 3 to Plaintiff’s complaint and can, therefore, be considered by the Court. The policy does not comply with the requirements of § 1798.83 (c)(2). The phrase “direct marketing” does not appear anywhere in the Privacy Policy. There is no provision requiring the customer’s agreement before information is provided.
“Further, the second paragraph of the policy reads as follows: ‘Please know that Tillys will never disclose your personal information to any third party, unless it is necessary to provide you with products or services from Tillys or as otherwise described in our Privacy Policy…’
“That language could be interpreted as suggesting that information may be disclosed to third parties for unspecified reasons.
“In addition, the policy also contains the following language: We may allow third-party companies to serve ads or collect certain information about you when you visit the Sites. These companies may use browsing information (e.g., click stream information, Web browser type, time and date, subject of advertisements clicked or scrolled over) during your visits to the Sites and other web sites in order to provide advertisements about products and services likely to be of interest to you. These companies typically use a cookie or other technology to collect this information....Defendant’s privacy policy does not adopt “a policy of not disclosing personal information of customers to third parties for the third parties’ direct marketing purposes unless the customer first affirmatively agrees to that disclosure.” The demurrer is overruled on this ground.” Gonzales Vs Tilly’s Inc., 30-2018-00999952-CU-BT-CXC (1/25/2019) (https://trellis.law/ruling/30-2018-00999952-CU-BT-CXC/gonzales-vs-tillys-inc/20190125616bb0
Gravatt attaches to the complaint some sort of document entitled “privacy policy.” Apple allegedly breached this contract by engaging in “privacy (extreme cruelty), 4th, 14th amendment,” and Mr. Gravatt suffered damages “as follows: privacy 4th amendment.” Understandably, Apple has filed a demurrer on the grounds that the complaint fails to state a valid cause of action, is uncertain, and fails to appropriately identify the contract sued upon. The demurrer is unopposed. · Mr.
Jun 21, 2017
Steven D. Blades or Brian S. Currey
Los Angeles County, CA
Gravatt attaches to the complaint some sort of document entitled “privacy policy.” Apple allegedly breached this contract by engaging in “privacy (extreme cruelty), 4th, 14th amendment,” and Mr. Gravatt suffered damages “as follows: privacy 4th amendment.” Understandably, Apple has filed a demurrer on the grounds that the complaint fails to state a valid cause of action, is uncertain, and fails to appropriately identify the contract sued upon. The demurrer is unopposed. · Mr.
Jun 21, 2017
Steven D. Blades or Brian S. Currey
Los Angeles County, CA
Gravatt attaches to the complaint some sort of document entitled “privacy policy.” Apple allegedly breached this contract by engaging in “privacy (extreme cruelty), 4th, 14th amendment,” and Mr. Gravatt suffered damages “as follows: privacy 4th amendment.” Understandably, Apple has filed a demurrer on the grounds that the complaint fails to state a valid cause of action, is uncertain, and fails to appropriately identify the contract sued upon. The demurrer is unopposed. · Mr.
Jun 21, 2017
Steven D. Blades or Brian S. Currey
Los Angeles County, CA
Gravatt attaches to the complaint some sort of document entitled “privacy policy.” Apple allegedly breached this contract by engaging in “privacy (extreme cruelty), 4th, 14th amendment,” and Mr. Gravatt suffered damages “as follows: privacy 4th amendment.” Understandably, Apple has filed a demurrer on the grounds that the complaint fails to state a valid cause of action, is uncertain, and fails to appropriately identify the contract sued upon. The demurrer is unopposed. · Mr.
Jun 21, 2017
Steven D. Blades or Brian S. Currey
Los Angeles County, CA
Gravatt attaches to the complaint some sort of document entitled “privacy policy.” Apple allegedly breached this contract by engaging in “privacy (extreme cruelty), 4th, 14th amendment,” and Mr. Gravatt suffered damages “as follows: privacy 4th amendment.” Understandably, Apple has filed a demurrer on the grounds that the complaint fails to state a valid cause of action, is uncertain, and fails to appropriately identify the contract sued upon. The demurrer is unopposed. · Mr.
Jun 21, 2017
Steven D. Blades or Brian S. Currey
Los Angeles County, CA
He attaches to the complaint what appears to be Apple’s privacy policy – or information about that policy – to the complaint, and this appears to be the “agreement” that he claims has been breached. His complaint also refers to privacy, extreme cruelty, and the 4th and 14th amendments, although the meaning is incomprehensible. He seeks $400 million in damages. Gravatt filed his complaint on December 20, 2016. He filed a number of other incoherent complaints in this court against other defendants.
Feb 28, 2017
Brian S. Currey or John A. Slawson
Los Angeles County, CA
Defendant seeks to compel arbitration of this case in South Carolina, pursuant to the Terms of Use & Privacy Policy (“Agreement”).
Jan 27, 2017
Los Angeles County, CA
The other items in the “Notices” section are a warning that ACBL dues are not tax deductible and can be changed at any time, a statement that dues include subscriptions to various publications, an admonition that a member’s residence determines which ACBL unit/district the member is a part of, and a link to a website for information on ACBL’s privacy policy.
Dec 16, 2016
Contra Costa County, CA
Also, any action brought by plaintiff is to be litigated in South Carolina, pursuant to the Terms of Use & Privacy Policy. RULES OF COURT RULE 3.1113(d): Plaintiff Christopher Bory (“plaintiff”)’s opposition is 19 pages long, in violation of Rules of Court Rule 3.113(d), which states that “[e]xcept in a summary judgment or summary adjudication motion, no opening or responding memorandum may exceed 15 pages.”
Dec 06, 2016
Los Angeles County, CA
Marsted’s firm has refused to give the information based upon their Privacy Policy without mother’s authorization; father requests (1) that mother produce or have her father produce all statements for the children’s Schwab Accounts for which she is/he was/is the custodian for the period of 1/1/2007 to the date of production [the date of separation was July 2007; claims there may be disputes]; (2) that he be named custodian of those accounts; (3) that mother pay $3,000 in attorney fees for sanctions.
Oct 23, 2012
Santa Barbara County, CA
By signing below, I/we hereby acknowledge receipt of this document, that the information contained herein is true and correct, and that I/we have read and understand ePLANNING’s Privacy Policy. [Bold in original.] Both Edward and Barbara signed directly under this advisement. Both Edward and Barbara also signed two Client Investment Advisory Agreements – one on December 20, 2006 (individually) and one on December 22, 2006 (as trustees of the Withey Family Charitable Remainder Trust 12/22/06).
Feb 07, 2011
Santa Barbara County, CA
By signing below, I/we hereby acknowledge receipt of this document, that the information contained herein is true and correct, and that I/we have read and understand ePLANNING’s Privacy Policy. [Bold in original.] Both Edward and Barbara signed directly under this advisement. Both Edward and Barbara also signed two Client Investment Advisory Agreements – one on December 20, 2006 (individually) and one on December 22, 2006 (as trustees of the Withey Family Charitable Remainder Trust 12/22/06).
Nov 08, 2010
Santa Barbara County, CA
Please wait a moment while we load this page.
