California: CAADCA Enforcement Stay Ends; New Data Broker Settlement

Want to receive these privacy recaps in your inbox each week? Subscribe here.

USA

California Age Appropriate Design Code Enforcement Stay Ends March 6

The joint stipulation to stay California’s enforcement of the provisions of the California Age Appropriate Design Code Act (CAADCA) provisions no longer subject to an injunction will end March 6, 2025.

TAKEAWAY

As of March 6, portions of the CAADCA that are not subject to an injunction (i.e., all portions other than DPIA requirements) will be enforceable by the Attorney General’s Office against services likely to be accessed by children under the age of 18, including requirements to either estimate the age of users with a “reasonable level of certainty” or to apply child-appropriate protections for all users.

Meanwhile, the case challenging the constitutionality of the law (Case 5:22-cv-08861-BLF in the North District of California) is still pending. Netchoice (the Plaintiff in the case) moved for a second preliminary injunction after the Ninth Circuit vacated (in part) and remanded the first preliminary injunction back to the District Court. Netchoice is arguing that the remaining provisions facially violate the first amendment and are not severable from the already-enjoined DPIA provisions. A hearing on that motion was held January 23, 2025, but neither an order on that motion nor a joint stipulation extending the enforcement stay has been issued, leaving companies subject to the law vulnerable to potential enforcement. 

Data Broker Must Cease Operations for 3 Years In Delete Act Settlement

The latest settlement announced by the California Privacy Protection Agency under the Delete Act will require unregistered data broker Background Alert, Inc. to shut down its operations through 2028 as part of a settlement over the company’s failure to register and pay an annual fee under the Delete Act. Background Alert allegedly created and sold profiles about people through its website by amassing billions of public records, drawing inferences from those records to identify people associated with a “searched-for individual” and identify patterns to generate profiles.

TAKEAWAY & RELATED NEWS

The CPPA’s enforcement efforts have been giving companies insights into the CPPA’s interpretation of the Delete Act, including the definition of a “Data Broker”. This action (and the CPPA’s announcement) make clear that the CPPA “won’t hesitate to pursue violations based on inferences and profiling”.

On the same day, the CPPA released, as part of materials for an upcoming board meeting, proposed text for an amendment narrowing the definition of “Direct Relationship”, which, if adopted, would further broaden application of the Delete Act.

The Delete Act applies to businesses that collect or sell the data of consumers with whom the business does not have a “direct relationship”, and the proposed text (among other changes) aims to clarify that “a business does not have a ‘direct relationship’ with a consumer simply because it collects personal information directly from the consumer; the consumer must intend to interact with the business” and that “a business is still a data broker…as to personal information it sells about the consumer that it collected outside of a ‘first-party’ interaction with the consumer”.

These changes would essentially include in the scope of a Data Broker any entity that collects information in a “third party” context and onward sells that information.  

A Little Privacy, Please weekly recaps are provided for general, informational purposes only, do not constitute legal advice, and should not be relied upon for legal decision-making. Please consult an attorney to determine how legal updates may impact you or your business.