On July 30, 2024, New York Attorney General Letitia James announced two new privacy guides that could affect your business, a Business Guide to Website Privacy Controls and a Consumer Guide to Web Tracking.

The Guides are intended to protect visitors to websites whether or not a purchase is made. They focus upon identifying common mistakes businesses make “when deploying tracking technologies, processes they can use to help identify and prevent issues, and guidance for ensuring they comply with New York law.” The Guides provide visual and textual examples of good and bad practices.

The Attorney General issued these Guides following a review of a number of popular sites. In its review, the AG’s office uncovered unwanted tracking or misleading opt-ins or opt-outs, mischaracterizations of some tracking tools as “essential” or what it considers to be other unfair or deceptive business practices. Some of these are discussed in the release and others can be found in the Guides. The release also includes examples of disclosures that some of the sites made and AG commentary on the disclosures.

The Business Guide lists steps the Attorney General will expect online advertisers, websites and others using tracking tools on their websites to take to avoid potentially misleading or deceiving consumers or prosecution by the AG’s office. The following are specifically identified in the promulgating release by the AG’s office as important things that a company should do if it uses tracking technologies:

• Designate: Designate a qualified individual (or individuals) to be responsible for implementing and managing website-tracking technologies. These individuals should have appropriate training, including on your business’s tracking technologies and policies.
• Investigate: Before deploying a new tag or tool or changing how an existing tag or tool is used, take appropriate steps to identify the types of data that will be collected and how the data will be used and shared. In some cases, this may require asking the developer of the tag or tool to provide information that is not publicly available.
• Configure: When deploying a new tag or tool or changing how your business uses a tag or tool, ensure that it is appropriately categorized and configured.
• Test: Conduct appropriate testing to ensure that tags and tools are operating as intended. Test both on a regular basis and when your business has made changes that affect how website visitors are tracked. Automated scanning tools can help, but be sure that you understand the types of issues that these tools can and cannot identify.
• Review: Conduct reviews on a regular basis to ensure tags and tools are properly configured. The scope of any review will depend on the tags and tools your website uses. In most cases, reviews should ensure that tags are properly categorized in a consent-management tool and that any tag-management tool is properly synced.

The issuance of the Guides demonstrates that the NY Attorney General is serious about regulating inappropriate or misleading tracking cookies, tags and other tracking technologies and that the AG will use the Guides to measure compliance with good business practices and New York law. We believe the AG is thus indicating that it will target companies using websites tracking tools inappropriately for enforcement action by the AG’s office.

The examples in the Guides highlight mis-categorizing tracking tools, failing to clearly provide consumers with a clear and simple means of effectively making opt-out decisions concerning what information is not to be tracked, failing to use plain English and clear buttons/links to clearly explain the choices available to the consumer, and failing to honor consumer choices concerning tracking. While the Guides are focused on protecting New Yorkers, other businesses that make their sites available to New Yorkers are also subject to regulation by the AG’s office. The Guides provide excellent guidance for companies doing business online anywhere in the country.

TAKEAWAYS:

• Companies should review both the Business Guide and the Consumer Guide to help them to adopt appropriate practices for websites.
• As part of an effective corporate governance processes, a company should
  • designate someone with appropriate training and oversight authority to oversee its tracking policies and technologies and to implement appropriate changes to how language, technology and how tags and tools operate
  • periodically review its on-line tracking, technologies, tools and choices to assure that how it describes the opt-in or opt-out for tracking cookies, pixels, tags and other tools that the Company uses are clear to consumers
  • only collect information necessary for the purposes intended by the Company
  • keep track of the data collected by its tools and cookies to assure that its website and technologies give appropriate choices
  • keep the information no longer than is necessary or useful for the intended purpose
  • test and audit its processes to make sure that a consumer’s decision concerning her, his or their (or their child’s) information is honored by the Company
  • periodically review/audit, test and update, as necessary, the Company’s data protection and security policies and procedures as well as its tracking policies, consent-management tools and tag-management tools whether they be home grown or acquired from a third party