On January 28, 2022, the California Attorney General (AG) sent out numerous notices alleging noncompliance with the California Consumer Privacy Act (CCPA) as part of an “investigative sweep” of covered businesses’ loyalty programs. Under the CCPA, a business that offers a “financial incentive,” or “a program, benefit, or other offering, including payments to consumers, related to the collection, deletion or sale of personal information,” must provide a Notice of Financial Incentive to the consumer before they opt into the program. The AG’s announcement focused on brick-and-mortar entities specifically, citing the proliferation of loyalty programs that offer a financial incentive, from shopper’s club cards to mobile phone check-ins at the local café for free coffee. Businesses that receive a notice of noncompliance will have only 30 days to cure the alleged CCPA violations or face enforcement action.
However, the Notice of Financial Incentive applies to both online and brick-and-mortar businesses alike and is not strictly limited to discounts or coupons. Such notice is also required if the business provides any difference in the level or quality of goods or services in relation to collection, retention, or sale of consumers’ personal information as a result of opting in or out of the loyalty program.
The Notice of Financial Incentive must disclose the “material terms” of the loyalty program, which includes, among other things, a statement identifying and explaining the consumer’s right to leave the loyalty program. However, other required disclosures may be more difficult to provide. In particular, a business must explain how the financial incentive is “reasonably related to the value of the consumer’s data,” which includes a “good-faith estimate of the value of the consumer’s data that forms the basis” for the loyalty program and “a description of the method the business used to calculate [that] value . . . .”
To date, guidance from the AG’s office regarding the Notice of Financial Incentive has only focused on the lack of notice, not its contents. This lack of substantive guidance may further complicate compliance as entities consider other business implications, including the potential that trade secrets are implicated by these requirements.
Overall, businesses concerned about drafting a Notice of Financial Incentive should note that the complete absence of notice is very easy to spot from the perspective of state regulators and consumers alike. Furthermore, entities may wish to act before January 1, 2023, when the Consumer Privacy Rights and Enforcement Act (CPRA) takes effect and eliminates the CCPA clause that broadly provides for AG notice of any alleged noncompliance and a corresponding 30-day opportunity to cure.
