Ad Law News and Views - March 20, 2021

[“

LATEST UPDATES

Get these and other stories in real time when you subscribe to the Ad Law Access blog here. 

NAD Addresses Math Problems in Counting Reviews

Function claimed that it had ​“over 110,000 5-star product reviews” for its hair care products, the majority of which come from its ​“shampoo and conditioner” category. A competitor filed an NAD challenge pointing out that the total number of 5-star reviews across all product categories was only 63,831. So how did Function get to 110,000? Normally, I turn to our team of economists at Georgetown Economic Services to sort through these tricky math questions, but I was able to figure this one out on my own.

California Privacy Protection Agency Appointments Announced

California officials today announced their nominees to be the five inaugural members of the California Privacy Protection Agency (CPPA) Board.  Created by the California Privacy Rights Act (CPRA), the CPPA will become a powerful, state-level privacy regulator long before its enforcement authority becomes effective in 2023, and today’s appointments move the CPPA one large step closer to beginning its work.  This post provides an overview of the CPPA’s authority, examines the issues that might be on its agenda, and outlines a few ways companies can start to get ready for potential regulations.

Further Amendments to CCPA Regulations Are Approved and in Effect

California’s Office of Administrative Law approved further revisions to the Attorney General’s CCPA regulations on March 15, 2021.  The revisions went into effect upon approval.  In substance, the revisions are identical to the fourth set of modifications the Attorney General proposed on December 10, 2020.

NAD Decision Suggests Expansive Definition of Advertising

As part of its routine monitoring program, NAD asked ACT to provide substantiation for statements the company made online about its standardized college entrance test. NAD was concerned about whether ACT sufficiently disclosed the likelihood of cancellations due to COVID-19 and statements about test center availability. The decision is interesting because it sheds light on what NAD considers to be an ad and how NAD finds cases.

State Privacy Update

Oklahoma: Oklahoma’s proposed Oklahoma Computer Data Privacy Act closely models the CCPA on most consumer privacy rights with the notable exception that it provides opt-in rights to consumers for both the sale and collection of their personal information. The measure also allows businesses to provide financial incentives to consumers, including compensation, for the collection, sale, or disclosure of a consumer’s personal information, but requires the business to disclose the material terms of the program and obtain opt-in consent. The bill does not include a private right of action and explicitly provides that any federal privacy measure would preempt the Oklahoma law, if passed. The bill passed in the state House at the beginning of this month and has now moved on to the Senate. If enacted, the law would become effective on January 1, 2023.

Texas: Introduced yesterday, the untitled Texas bill is unique in its categorization of personal information. The bill distinguishes personal information into categories 1 (e.g., SSN, driver’s license number, financial account numbers), 2 (e.g., racial or ethnic origin and religious information, tracking data, genetic information), and 3 (e.g., time of birth, political party). The bill also separately broadly defines personal identifying information similar to other measures. Along with the expected consumer requests, the bill does not permit selling, transferring, or communicating category 2 information, or collecting or processing category 3 information. The bill only permits geolocation tracking or selling geolocation information with prior express consent. Similar to Oklahoma, the Texas bill includes explicit requirements for providing consideration or incentives to consumer in exchange for their personal information. The bill does not include a private right of action and, if enacted, would go into effect on January 1, 2022.

Rhode Island: Compared to the other two, the Rhode Island Data Transparency and Privacy Protection Act is sparse. The bill is limited to certain types of information commonly addressed in data breach laws (e.g., first name or first initial in combination with certain data elements, such as SSN or account information and access code). The bill does not address consumer requests, but rather requires notice of an operator’s information sharing practices. The bill was introduced at the end of February and referred to the House Corporations Committee.

Florida: The Florida House is considering an untitled privacy bill that would go into effect on January 1, 2022 if passed; the bill was recently added to the Civil Justice and Property Rights Subcommittee agenda. The bill provides for many of the same data subject requests, but also allows for an opt out of sharing personal information with third parties, in addition to sales. Sharing is defined broadly to mean to ​“share, rent, release, disclose, disseminate, make available, transfer, or access a consumer’s personal information for advertising.” The bill would provide a limited private cause of action for individuals who have limited types of information disclosed in data breaches. The Florida legislature’s Regulatory Reform Subcommittee gave the bill a favorable report, with the understanding that the legislature could make further changes outside of committee. There is also this privacy bill, the Florida Privacy Protection Act pending in Florida’s Senate that is being considered as well with some distinctions from the House version.  

What People Are Saying: ​“When we started, we didn’t know where the data was going – and we still don’t. I understand the businesses don’t want 50 different state laws, but the federal government is not doing anything. Maybe if a few more states do something like this it will cause some action on the federal level.” Oklahoma State Rep. Josh West (R-Oklahoma City), co-author of the Oklahoma Computer Data Privacy Act, on why the bill is necessary.

Telephone Consumer Protection Act (TCPA)

TCPA Tracker March 2021

Kelley Drye provides a monthly comprehensive summary of pending petitions and FCC actions relating to the scope and interpretation of the TCPA.

Inside the TCPA Podcast, Episode 9: Robocall Mitigation Plans

This latest episode of the Inside the TCPA series provides an update on the new FCC requirement for voice service providers to develop and implement robocall mitigation programs. Building on their Episode 7 discussion of the STIR/SHAKEN framework, It discusses when providers need to implement mitigation programs and what needs to be included. It also offers recommendations for customizing a program to fit a provider’s needs and how to build a program that is both effective and manageable. 

COVID-19 Weekly Digest - March 19, 2021

Kelley Drye has been monitoring developments and providing up-to-date information about the potential legal and business implications of the coronavirus pandemic. Advisories and legal updates on COVID-19 from this week are below and can be found on our COVID-19 Resource Center on our website.

To subscribe to all our COVID-19 related communications, please click here.

TOP READS

”]