California Attorney General is Filing Suits on Mobile App Privacy Policy Violations

The California Business and Professions Code Section 22575-22579 (“CalOPPA”) requires that “an operator of a commercial website or online service that collects personally identifiable information (“PII”) through the Internet about individual consumers residing in California who use or visit its commercial website or online service” must post a privacy policy that complies with specified requirements. [Cal. Bus. & Prof. Code § 22575(a) and (b).] The privacy policy must be “conspicuously” posted, and in the case of an online service, “reasonably accessible ... for consumers of the online service.” [Cal. Bus. & Prof. Code § 22575(a) and § 22577(b)(5).] A website or online service operator that collects PII and “fails to post its policy within 30 days after being notified of noncompliance” is in violation of CalOPPA. [Cal. Bus. & Prof. Code § 22575(a).] An operator of a mobile application (“app”) that uses the Internet to collect PII is an "online service" within the meaning of CalOPPA. An app’s commercial operator must therefore conspicuously post its privacy policy in a means that is reasonably accessible to the consumer within the app itself. Having a website with the applicable privacy policy conspicuously posted may be adequate, but only if a link to that website is “reasonably accessible” to the user within the app. Violations of CalOPPA may result in penalties of up to $2,500 for each violation, i.e., for each copy of the unlawful app downloaded by California consumers. [Cal. Bus. & Prof. Code § 17206(a).]