Loyalty Comes At A Price: Don't Forget To Include CCPA's Notice Of Financial Incentive

In January 2022, many businesses operating loyalty programs in the State of California received notices for allegedly violating the California Consumer Privacy Act ("CCPA"). Like the notice sweep in July 2021, California's Attorney General published a brief  press release describing the violations and subsequent notices alleging non-compliance with the CCPA's Notice of Financial Incentive ("Notice") requirements. According to the press release, the recent notice sweep focused on businesses that allegedly failed to provide a Notice of Financial Incentive to consumers who had opted in to their loyalty programs. 

To avoid civil penalties for CCPA violations, businesses operating loyalty programs in California should retain competent  legal counsel to ensure that they are in compliance with the CCPA's Notice of Financial Incentive requirements.

What are the CCPA's Notice of Financial Incentive Requirements?

The purpose of the CCPA's Notice of Financial Incentive requirements is to ensure that consumers are aware when their information will be collected, used and, in some instances, sold/shared, in exchange for the receipt of a financial benefit. A "financial incentive" is defined as a program, benefit, or other offering (e.g., payments to consumers or  10% discounts) related to the collection, deletion, or sale of personal information. Pursuant to the CCPA, businesses that offer financial incentives (e.g., loyalty programs) or price/service differences in exchange for personal information must provide consumers with this CCPA Notice.

The Notice of Financial Incentive must be prominently displayed, easy to read, and clearly describe the material terms of the financial incentive program to consumers before the consumer is prompted to opt in to the program. It is important to note that, if businesses offer their financial incentives online, their Notices may be provided by linking to the relevant financial incentive section of their respective privacy policies.

To ensure that the Notice of Financial Incentive is easy for consumers to read and understand, the Notice must:

1. Use plain, straightforward language;
2. Use a format that is attention-grabbing and readable (even on small screens);
3. Be available in the languages in which the business uses in its ordinary course of business (i.e., the languages used to promote the loyalty program);
4. Be reasonably accessible to consumers with disabilities; and
5. Be present where consumers will encounter it before opting-in to the financial incentive.

In addition, the Notice must clearly describe the material terms of the financial incentive program to consumers before they opt-in. Such material terms include:

1. A summary of the financial incentive;
2. The categories of personal information that are implicated;
3. The value of the consumer's data;
4. The consumer's right to withdraw (i.e., opt-out) at any time;
5. How the consumer can opt-in and opt-out;
6. How the financial incentive is reasonably related to the value of the consumer's data (including a good faith estimate of the value and the method for calculating such value).

January 2022 Notice Sweep

As mentioned above, the subject CCPA notice sweep focused on businesses that allegedly failed to provide a Notice to consumers that opted in to their loyalty programs. California's Attorney General sent these notices to major corporations in the retail, home improvement, travel, and food services industries. The press release also warned brick and mortar stores and other businesses that the CCPA's Notice of Financial Incentive applies to both online and offline  data collection. For example, such offline practices include: (1) entering a phone number for a discount at a supermarket; (2) using rewards for a free coffee at a local coffee shop; and (3) earning points to purchase items at a favorite clothing store.

Penalties for Non-compliance with CCPA's Notice of Financial Incentive

After being notified of alleged non-compliance, businesses have 30 days to cure alleged violations. Businesses that fail to cure such violations may be subject to injunctions and civil penalties of no more than $2,500 for each violation and $7,500 for each intentional violation. 

Similar Blog Posts:

The CPRA Sensitive Personal Information Data Category

Privacy Policies for Websites and Mobile Applications

How Does the Colorado Privacy Law Compare to the CCPA?

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.