The state of enforcement: Part I — Consumer privacy rights

Data privacy-related public enforcement activities continue to accelerate. Armed with new laws that have come into force, state attorneys general and the California Privacy Protection Agency are investigating more potential violators. All U.S. state comprehensive consumer privacy statutes include consumer privacy rights and establish procedures for covered entities to allow consumers to exercise these rights.

California’s enforcers have focused most of their efforts on investigating companies that create unnecessary friction or fail to process consumer rights requests. In particular, they have focused on the right to opt out of sales and sharing personal information, where design flaws that allow the disclosure of personal information to third parties can have a more direct effect on consumers.

Requiring additional information from consumers to exercise rights

CalPrivacy has engaged in multiple investigations of companies that require additional information from consumers to process their requests to opt out from the sale or sharing of personal information. Such additional information requests directly contradict California Consumer Privacy Act regulations. 

Under Cal. Code Regs. Tit. 11, §§ 7026(d), 7027(e) and 7060(b), businesses cannot require identity verification or unnecessary additional information to fulfill opt-out requests. CalPrivacy has explained that collecting this additional information increases the likelihood that sensitive information will be collected or that an undue burden will be imposed on the consumer.