New California Direct Marketing Disclosure Statute Will Impact Most Online Sellers

2/1/2005

Effective January 1, 2005, California's new direct marketing disclosure statute will impact all online sellers who collect or have collected, in connection with a business transaction, personal information from consumers residing in California. Such businesses are required to provide notice to California consumers of their rights under the statute and how they can obtain information on personal information provided to third-party direct marketers. There are several authorized notice options, but the easiest one is to modify the company's online privacy policy to notify the consumer of his or her rights and to designate an address or toll-free number that the consumer may use to request specified information, including the identity of third parties who have been provided personal information within the last year.

This statute will require most online sellers to revise their privacy policies. Note that the statute does not regulate disclosure of personal information, but rather merely provides a mechanism by which consumers may obtain information about a company's personal information disclosure practices.

With limited exceptions, the statute covers any disclosure to a third party of personal information about a California resident. "Third party" is defined broadly in the statute and includes an affiliate of the disclosing party, if the affiliate is a separate legal entity. There are exclusions for certain disclosures to third parties in connection with implementing a transaction with a California resident, such as third parties who provide data administration or customer service, as long as those third parties do not use or disclose the information for their own "direct marketing purposes." In addition to direct solicitations, "direct marketing purposes" is defined to include selling, renting, exchanging, or leasing personal information to other businesses.

Businesses subject to the new law are those that during the prior calendar year have disclosed "personal information" to "third parties," when the business knew or reasonably should have known that these third parties used the personal information for their own direct marketing purposes. "Personal information" includes any information that identifies an individual, including name, residence address, email address, age or date of birth, number of children, telephone number, information regarding products purchased, payment history, debit or credit card information, and medical information.

Businesses subject to the new law will need to amend their privacy policies and to set up a procedure for providing the required notice to California residents and to provide required information in response to consumer requests.

Jere M. Webb
Stoel Rives LLP
jmwebb@stoel.com