California AG Extends CAADCA Enforcement Stay; VPPA Claims Against Scientific American Overcome Motion to Dismiss

Want to receive these privacy recaps in your inbox each week? Subscribe here.

USA

California AG Extends CAADCA Enforcement Stay Through April 5

Two days before the previous stay expired, the California Attorney General agreed in a Joint Stipulation to an additional one-month stay on enforcement of the California Age Appropriate Design Code Act (CAADCA), now expiring April 5, 2025. As in the previous stay, AG Bonta again agreed to never attempt to enforce any provision of the CAADCA allegedly violated before expiration of the stay. 

TAKEAWAY

The fate of the CAADCA is currently in the hands of the U.S. District Court for the Northern District of California, where oral arguments on Plaintiff Netchoice’s motion for a second preliminary injunction were heard January 23, 2025. An order on that motion has not yet been issued, so although companies subject to the law have a one-month reprieve from enforcement, they are still in limbo as to whether, and to what extent, the law will be enjoined or enforcement will be further stayed.

If neither happens by April 5, services likely to be accessed by children under the age of 18 will be required to estimate the age of users with a “reasonable level of certainty” (or apply child-appropriate protections for all users) and comply with all other aspects of the law other than requirements to complete data protection impact assessments, injunction of which was upheld by the Circuit Court as part of the first preliminary injunction.   

VPPA Claims Against Scientific American Overcome Motion to Dismiss

A judge in the Southern District of New York (SDNY) (Case 1:24-cv-04493-LJL) refused to dismiss claims against Springer Nature American, based on allegations that the company’s website scientificamerican.com violated the Video Privacy Protection Act (VPPA) by knowingly disclosing to Meta the Facebook IDs and URLs identifying pre-recorded videos viewed by class members on the website without the class members’ informed written consent.

TAKEAWAY

The decision in this case leans heavily on a recent Second Circuit decision against the NBA, holding that exposure of personally identifiable information to an unauthorized third party that uses the information for commercial gain is sufficient to allege a concrete injury in fact and that a person is a “subscriber” under the VPPA by providing consideration in the form of personal information in exchange for a good or service. In this case, visitors to scientificamerican.com were required to subscribe and provide a full name and email address in order to view more than three videos on the website, which the court held to be sufficient to make the plaintiffs “subscribers” under the VPPA.

Although the Second Circuit has not addressed which types of digital information fall within the scope of the VPPA, the SDNY court in this case determined that a Facebook ID, which enables access to the individual’s Facebook profile and therefore the individual’s identity, is sufficient to constitute PII under the VPPA. 

To learn more about mitigating risk under VPPA, watch our webinar.

A Little Privacy, Please weekly recaps are provided for general, informational purposes only, do not constitute legal advice, and should not be relied upon for legal decision-making. Please consult an attorney to determine how legal updates may impact you or your business.