Client Alert
Billee Elliott McAuliffe, Alfred J. Ludwig, Melissa G. Powers, Cassidy C. Kolaz
share this page:
On Data Privacy Day (January 28), California Attorney General Rob Bonta issued a statement on a recent “investigative sweep” conducted by the California Office of the Attorney General concerning businesses operating loyalty programs and their compliance with the financial incentive requirements of the California Consumer Privacy Act of 2018 (the “CCPA”). Based on the findings of the investigation, the Attorney General sent notices of noncompliance to businesses that are allegedly failing to provide notices of financial incentive programs to customers that opt into their loyalty programs, as required by the CCPA.
The Attorney General sent these notices to a variety of businesses, including retailers, home improvement businesses, travel and food service industry members, as well as data brokers, marketing companies, businesses handling children’s information, media outlets, and online retailers. Businesses that received notices of noncompliance have 30 days from the date of the notice to cure any alleged violation or the Attorney General can initiate enforcement actions. Notably, starting January 1, 2023, once the California Privacy Rights Act of 2020 (the “CPRA”) takes effect, this 30-day cure period will be eliminated and the recently established California Consumer Protection Agency will have the discretionary power of whether to provide a business with time to cure an alleged violation or not.
Under the CCPA, businesses doing business in California that offer a “financial incentive,” which is defined as “a program, benefit, or other offering, including payments to consumers, related to the collection, deletion, or sale of personal information” and may include discounts, free items, or other rewards, in exchange for personal information must provide consumers with a notice explaining each financial incentive. The purpose of the notice of financial incentive is to explain to the consumer the material terms of a financial incentive so that the consumer may make an informed decision about whether to participate. In addition to the notice, the CCPA requires a business to receive a consumer’s prior opt-in consent in order to enter the consumer into a financial incentive and this consent may be revoked by the consumer at any time.
A business must provide the notice of financial incentive prior to entering a consumer into the financial incentive program and such notice must:
The statement from the California Office of the Attorney General made clear that the financial incentive requirements of the CCPA apply to personal information collected online, as well as, in-person. Further, the Attorney General warned “I urge all businesses in California to take note and be transparent about how you’re using your customer’s data. My office continues to fight to protect consumer privacy, and we will enforce the law.” If you need assistance with your CCPA compliance efforts or want more information on compliance with the CCPA or its financial incentive requirements, please contact one of our Cybersecurity & Data Privacy attorneys.

These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the site will not then work. These cookies do not store any personally identifiable information.
These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site. All information these cookies collect is aggregated and therefore anonymous. If you do not allow these cookies we will not know when you have visited our site, and will not be able to monitor its performance.
These cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.
These cookies enable the website to provide enhanced functionality and personalisation. They may be set by us or by third party providers whose services we have added to our pages. If you do not allow these cookies then some or all of these services may not function properly.