California Fines Sling TV $530K for CCPA Opt-Out Failures as CNIL Survey Validates Pay or Consent Models

Want to receive these privacy recaps in your inbox each week? Subscribe here.

California Attorney General Rob Bonta secured a $530,000 settlement with Sling TV over multiple California Consumer Privacy Act violations that made opt-out rights unnecessarily difficult to exercise. The streaming service failed to provide accessible opt-out mechanisms across devices, created confusion by separating cookie controls from CCPA opt-outs, and sold data of minors under 16 without required authorization.

The case establishes important precedent for how businesses must implement privacy controls across all consumer touchpoints, particularly when services operate primarily through apps rather than websites. Meanwhile, France’s CNIL released survey results reinforcing its support for “pay or consent” models, with data showing significant consumer willingness to pay for privacy-protective alternatives to targeted advertising.

Keep reading for a breakdown of the news and my takeaways on both matters.

United States

California AG Settles With Sling TV Over CCPA Failures

Attorney General Bonta announced a $530,000 settlement with Sling TV and Dish Media Sales (Sling TV) over allegations that the streaming service violated the California Consumer Privacy Act (CCPA) and California’s Unfair Competition Law. Specifically, the complaint alleged that Sling TV: 

(1) failed to provide easy-to-execute methods for consumers to opt out of the sale or sharing of personal information; 

(2) failed to provide easy-to-read and understand disclosures and communications to consumers, including by confusingly combining the CCPA opt out with cookie choices; 

(3) required a logged-in user submitting an opt-out request to fill out a webform and provide more information than necessary to direct the business not to sell or share their personal information; 

(4) required users to go to Sling TV’s website to opt out, rather than providing an opt-out method within the Sling TV app (reflecting the manner in which the business primarily interacts with its customers); and

 (5) sold or shared information of consumers known to be under age 16 for cross-context behavioral advertising without obtaining their affirmative authorization.

TAKEAWAY

This case has multiple notable factual aspects. First is Sling TV’s offering of two separate privacy mechanisms: 

1. cookie preference controls available behind a “Your Privacy Choices” link on its website; and
2. a separate webform available behind allegedly harder-to-find text-embedded links that users could complete to opt out of the sale or sharing of personal information. 

According to the complaint, the cookie preference controls only stopped certain cookies and tracking technologies on the specific browser used to access Sling TV’s website. This had no effect on Sling TV continuing to sell or share the consumer’s personal information when consumers returned to watching Sling TV on their living room device via the Sling TV app. Users could only direct Sling TV to stop all non-cookie-based selling and sharing of their personal information across browsers, devices, and offline by completing the webform. 

However, that option was allegedly harder to find and required additional, unnecessary steps. The combination of both methods allegedly caused added confusion because “consumers had to realize that rejecting cookies was not the same as submitting a CCPA opt-out and then had to locate a link embedded in text that directed them to a separate opt-out page”. 

Second, the method by which consumers regularly access Sling TV was an important fact in this case. Consumers typically access Sling TV via an app available for various living-room devices (like TVs, players, and gaming consoles), rather than through its website. However, consumers could only opt out via the website, not the app. This was alleged to be a violation of the CCPA requirement to offer an opt-out method that reflects the manner in which a business primarily interacts with the consumer. 

A final notable aspect is the list of factors contributing to the allegation that Sling TV had actual knowledge that consumers were under 16 years of age. Specifically, Sling TV received notification from programmers about children’s content, offered consumers the ability to use parental controls, and received and used demographic information (including the presence of children) from third-party data brokers about its consumers and their households for targeted advertising. Despite this knowledge, the complaint alleges that Sling TV failed to implement mechanisms to protect the privacy of viewers under 16, such as “kids profiles”, parental controls, or dedicated channels that turned off the collection, sale or sharing of personal information.  

Pay or Consent Survey “Confirms the Relevance” of CNIL’s Approach

A CNIL article examining a consumer survey on “pay or consent” models concludes that the survey results “confirm the relevance of the CNIL’s approach: offering more options to enable users to better protect their privacy and ensuring that their preferences are respected.” 

Specifically, the article highlights that a “significant proportion” (between 24% and 33% of those surveyed) are willing to pay for health and fitness tracking, generative AI, online news, and social media services, despite less than 10% of subscribers currently paying for subscriptions to such services, that those who already have a paid subscription are willing to pay more for a version without targeted advertising, and that 51% of respondents consider data protection to be one of the three more important criteria when choosing a digital service (with 21% ranking it as their top criteria).

TAKEAWAY

The article reveals that it is the first of a series of three articles on French people’s perceptions of the use of their personal data and consent to online advertising. Combined with the first article’s conclusion that the survey results confirm the relevance of the CNIL’s approach, this indicate that the CNIL is undergoing an exploration of, and at least so far confirming, its previous positioning on “pay or consent” models, where data subjects are given a choice between consenting to the processing of their personal data (and use of cookies) for targeted advertising or paying a fixed price for a subscription to access the applicable content or service. 

Guidance issued by the CNIL in 2022 allows for “pay or consent” offerings within certain parameters. This guidance considers whether a fair alternative to access the content is available, whether any payment required for users to refuse cookies is a “reasonable price”, whether the cookie wall is limited to the purposes that allow for fair remuneration, and whether the selection of the paid alternative results in appropriate limitation of unnecessary tracers. Since then, similar guidance and holdings have been issued by the European Data Protection Board as well as from other DPAs, such as the UK ICO and the Switzerland FDPIC.

A LITTLE MORE PRIVACY, IF YOU PLEASE

• Atlas browser by OpenAI: The end of free consent?
• GDPR, data governance, and why ‘It’s just a log’ is never just a log

A Little Privacy, Please weekly recaps are provided for general, informational purposes only, do not constitute legal advice, and should not be relied upon for legal decision-making. Please consult an attorney to determine how legal updates may impact you or your business.