California’s New Do-Not-Track Law Goes Into Effect January 1, 2014, Remember To Check Your Privacy Policy For Compliance

In the coming weeks, the California Attorney General is expected to release best practice guidelines for compliance with the law. This guidance may or may not include a strict interpretation of these and other compliance issues. Regardless of this forthcoming guidance, operators will be expected to comply as of the January 1 effective date.

As we have written before, ambiguities in the law complicate compliance. For instance, the law does not provide a definition of “do-not-track.” Without a statutory definition of do-not-track, or a commonly accepted definition by industry, businesses should take appropriate caution when describing in their privacy policy how they respond to do-not-track signals. Also, there is confusion as to whether an operator’s provision of a link to widely used industry opt-out mechanisms obviates the need for a do-not-track disclosure. In addition, the law does not make clear whether subsidiaries and affiliates of a website operator or online service constitute “other parties.” If they are, operators will have to disclose whether affiliates and subsidiaries track consumers’ activities on their websites or services.

While businesses can take some comfort in the fact that California provides 30 days to address alleged deficiencies raised by the Attorney General before any fines may be imposed, non-compliance eventually can result in fines of up to $2,500 per violation.

Authored by Bret Cohen and Jared Bomberg