New California Direct Marketing Disclosure Statute Will Impact Most Online Sellers
This statute will require most online sellers to revise their privacy policies. Note that the statute does not regulate disclosure of personal information, but rather merely provides a mechanism by which consumers may obtain information about a company's personal information disclosure practices.
With limited exceptions, the statute covers any disclosure to a third party of personal information about a California resident. "Third party" is defined broadly in the statute and includes an affiliate of the disclosing party, if the affiliate is a separate legal entity. There are exclusions for certain disclosures to third parties in connection with implementing a transaction with a California resident, such as third parties who provide data administration or customer service, as long as those third parties do not use or disclose the information for their own "direct marketing purposes." In addition to direct solicitations, "direct marketing purposes" is defined to include selling, renting, exchanging, or leasing personal information to other businesses.
Businesses subject to the new law are those that during the prior calendar year have disclosed "personal information" to "third parties," when the business knew or reasonably should have known that these third parties used the personal information for their own direct marketing purposes. "Personal information" includes any information that identifies an individual, including name, residence address, email address, age or date of birth, number of children, telephone number, information regarding products purchased, payment history, debit or credit card information, and medical information.
Businesses subject to the new law will need to amend their privacy policies and to set up a procedure for providing the required notice to California residents and to provide required information in response to consumer requests.
Jere M. Webb
Stoel Rives LLP