Joe Sullivan

The California Privacy Protection Agency (CPPA) Enforcement Division has issued a new advisory on dark patterns.  Under the California Consumer Privacy Act (CCPA), "dark patterns" refer to user interfaces designed to confuse or mislead consumers about their privacy choices. For example, if opt-out options are unclear or hard to find, they might be considered dark patterns. Businesses must offer consumers clear and easy-to-understand choices to exercise their privacy rights. Michael Macko, Deputy Director of the CPPA’s Enforcement Division said, “Dark patterns aren’t about intent, they’re about effect. The law gives consumers the right to make privacy choices without jumping through confusing hoops.” CPPA’s Enforcement Division regularly issues advisories on aspects of the CCPA. These advisories help educate the public and businesses about their rights and responsibilities under the law.    To learn more and read the Enforcement Advisory, visit: https://lnkd.in/gTff_KKZ  

110

3 Comments

On September 4, the California Privacy Protection Agency (CPPA) issued an Enforcement Advisory highlighting the issue of dark patterns under the California Consumer Privacy Act (CCPA). These dark patterns refer to user interfaces that manipulate or impair consumers' autonomy when making privacy choices, such as opting out of personal information sales or sharing. Key Highlights of the Advisory: - Dark Patterns: The term refers to design elements in user interfaces that mislead or confuse consumers, affecting their ability to make informed decisions about their privacy rights. - Clarity and Balance: Businesses must provide clear and balanced options for consumers when it comes to privacy choices, such as opting out of data sharing or sales. If the design causes confusion, it may violate the CCPA. - User Interface Review: The CPPA urges businesses to ensure their interfaces: - Offer symmetrical choices. - Use easy-to-understand language when presenting privacy options. For more updates on privacy and regulatory compliance, follow Global Regulatory Insights, unlock cutting-edge legal intelligence with a free subscription to our platform — join us today. Visit https://lnkd.in/gZmkUPim to know more. #PrivacyProtection #CCPA #DarkPatterns #UserRights #GRI

3

𝗖𝗮𝗹𝗶𝗳𝗼𝗿𝗻𝗶𝗮 𝗣𝗿𝗶𝘃𝗮𝗰𝘆 𝗣𝗿𝗼𝘁𝗲𝗰𝘁𝗶𝗼𝗻 𝗔𝗴𝗲𝗻𝗰𝘆 𝗔𝗱𝘃𝗮𝗻𝗰𝗲𝘀 𝗔𝗜 𝗥𝗲𝗴𝘂𝗹𝗮𝘁𝗶𝗼𝗻𝘀 The California Privacy Protection Agency (CPPA) has signaled it will advance rulemaking at its upcoming November 8 board meeting to place restrictions on the use of automated decision-making technology (ADMT) and impose new obligations to require businesses to conduct cybersecurity audits and risk assessments. The agency has grappled with these issues for more than two years, including soliciting formal comments in a February 2023 invitation for preliminary comments and conducting other stakeholder outreach. For more details on the upcoming regulations, check out the latest Ad Law Access article from Alysa Hutnik, Aaron Burstein, and Alexander Schneider: https://lnkd.in/e3zNVDE7 #CaliforniaPrivacy #CyberSecurity #AI #CPPA #RegulatoryUpdates #ADMT #DataProtection #KelleyDrye

11

Data privacy partner John Rolecki teamed up with with Michael Cole of Mercedes-Benz Research & Development North America, Inc. to co-author an insightful article for the International Association of Privacy Professionals regarding the intersection of privacy laws and artificial intelligence (AI). In their article, John and Michael explore the crucial balance between artificial intelligence (AI) innovation and essential privacy principles, sharing their collective expertise with the data privacy community. https://lnkd.in/gVmERj7F #DataPrivacy #AI #PrivacyProfessionals #IAPP

15

📢 New resource alert: Navigating US sensitive data privacy Sourcepoint is excited to announce our latest guide: "Navigating the maze: US privacy laws and sensitive data" This comprehensive resource covers: • How different US laws define sensitive data • Key enforcement agencies and recent actions • Best practices for processing sensitive information • A step-by-step framework for evaluating your data practices Download the PDF now to ensure your organization is prepared for the evolving US privacy landscape: https://hubs.ly/Q02H-T310

2

1 Comment

🌍🔍In today's interconnected world, cross-border investigations are more common than ever, but handling data across jurisdictions with varying privacy laws and data transfer regulations can be a daunting task.🌐 From GDPR (General Data Protection Regulation) to CCPA (California Consumer Privacy Act) in California, understanding and complying with these diverse legal frameworks is crucial. 🕵️‍♀️ A single slip-up can derail your efforts & lead to hefty fines. 🔑The key to success lies in precise data management practices that ensure compliance while facilitating seamless data transfers. Advanced case management tools automate compliance checks and secure data handling protocols. You can navigate the complexities of cross-border data management while staying on the right side of the law to uncover critical insights.💼📊 Let's connect and discuss strategies for successfully navigating the complex world of cross-border data management. Comment below to know more!

10

Eyeing a major shift in data control? The American Privacy Rights Act (APRA), a reworked federal privacy bill, just cleared a key House subcommittee. This is a significant development, but the path to becoming law remains to be seen. The APRA aims to empower Americans with greater control over their personal data, dictating how businesses collect and leverage it. Additionally, it strengthens online privacy safeguards for children. While some hail this as a victory for consumer rights, others express concerns about potential impacts on innovation or the bill's overall effectiveness. What's your take...does the APRA represent a positive step forward, or is it a missed opportunity? #privacy #APRA #dataprivacy #cybersecurity

5

California Privacy Protection Agency Updates: New Data Broker Regulations, ADMT Rulemaking, and Leadership Changes: The California Privacy Protection Agency (CPPA) continues to evolve as a central force in privacy regulation, advancing new rules and enforcement priorities that carry significant implications for businesses operating in California and beyond.... By: Baker Botts L.L.P. #dataprotection #dataprivacy #privacy

2

Norma Krayem, Van Scoyoc Associates Vice President and Chair of the Cybersecurity, Privacy & Digital Innovation Practice was interviewed by Charlie Mitchell of Inside Cybersecurity regarding the Supreme Court’s recent Chevron decision and the impacts the decision will have on federal regulators looking to develop cyber regulatory policies. “Having been a regulator in the past, there are clear boundaries that everyone knows that exist when promulgating a rule,” Krayem said. “Let’s be practical in why a regulation is needed and more importantly, not have agencies overreach and not ignore clear congressional intent that exists. Those that follow that will be on safe ground, but the SCOTUS decision makes clear that agency overreach, far beyond clear congressional intent and statutory authority, in any regulation, is on full notice.” Krayem stated, “It’s clear that overturning the Chevron doctrine will have an impact on cybersecurity and digital security issues, but it may not be as far-reaching as some are saying. However, it will force agencies to be very clear about their existing statutory authorities before they move to promulgate new regulations. Particularly for those existing safety regulations that have been interpreted to include cyber, most are on safe ground.” Krayem noted, “Cybersecurity mandates and the push for standards have been bipartisan for years. There are no blue or red views of whether we need to address cyber risks, particularly to critical infrastructure, and that includes using all available tools, including regulatory authorities. It’s unlikely that every agency’s current effort to interpret cyber mandates will be thrown out.” “In the case of cybersecurity,” she said, “there are clear risks to health and safety, economic, national and homeland security across the board. Cyber regulations are here to stay and more will be coming no matter who is in charge. At this point, that should be clear to every sector.” #artificialintelligence #nationalcriticalfunctions #governmentcontractors #cyberincidentreporting #cybersecuritymandates #regulatorypolicies   To read the full article, click here:  

2

A few notes from #PEPR24 (USENIX Conference on Privacy Engineering Practice and Respect - Santa Clara, CA), with a full day still to go: - Damien Desfontaines (Tumult Labs): Synthetic data is not the privacy-preserving silver bullet that many believe. Vendors should share empirical metrics, test for reconstruction and target outliers. (Damien is a former Masters of Privacy guest.) - Yuchao Tao (Snapchat): Unlike other social networks, #Snapchat does not share a member’s social graph. Snap leverages differential privacy to make sure that this is not compromised while suggesting new connections. It is still not risk-free, though (as made clear during the FAQ). #ABSet - Jordan Brandt (Inpher): Combining PETs (rather than picking one) is the way to go if we want to provide privacy safeguards while achieving high precision. Keeping data encrypted for as long as possible (eg., in Trusted Execution Environments) and adding noise (Differential Privacy) at the very end helps maintain such precision. - Jian Du and Shikun Airin (TikTok): Applying Secure Multiparty Computation alone provides “input privacy” in ad performance measurement, but does not guarantee output-related safeguards, so #DifferentialPrivacy should be applied on top. - Matt Gershoff (Conductrics): We need to be intentional about the data that we collect. This boils down to discarding “magical thinking” about the abstract possibilities of collecting data without control. Minimizing granularity and "linkability" in AB Testing can deliver k-anonymity, providing efficient computations/storage and beyond, as well as guaranteeing alignment with privacy by design and privacy by default principles. - Daniel Simmons-Marengo (Tumult Labs): How can we provide anonymization while it remains such an elusive target? Be skeptical about it, minimize assumptions, do not rely on governance, build with composability in mind and expose your technique to others. Looking forward to the rest of the sessions! #privacyengineering

41

The California Privacy Protection Agency published its second Enforcement Advisory warning about the use of “dark patterns” – those interfaces that impair a website user’s ability to make a choice regarding the collection, use, or disclosure of their personal information. Usama Kahf (CIPP/US) and Kate Dedenbach share four steps you should take to ensure you comply with this latest warning: https://bit.ly/3MHmSlJ. #privacy #cyber #consumerprivacy #CCPA #workplacelaw

6

In our latest #FMG blog, we explore Vermont's 2024 proposed Data Privacy Act (VDPA), which grants residents the right to sue large data holders. This sets Vermont apart from California's Consumer Privacy Act (CCPA) and highlights the evolution of state privacy laws in the U.S. Click the link below to learn more. FMG authors: Justin Boron, Matt Delfino, and Danielle Ocampo. #FMGLaw #CyberPrivacyandSecurity #Vermont #California https://bit.ly/4cfNWDA

12

Embark on a 4-day journey with the Cellebrite eDiscovery Investigations Practitioner (CEIP) course! Perfect for entry-level investigators, learn the legal nuances of targeted data collection, best practices in planning, and master the art of data extraction from computers, cloud sources, and mobile devices. Ready to elevate your eDiscovery game? http://ms.spr.ly/6044Y6dg6 #eDiscovery #CorporateInvestigations

2

"‘KOSA risks creating a tangled thicket of compliance issues, eroding digital privacy, and placing heavy burdens on small developers.’ 🌐 📜The Kids Online Safety Act (KOSA) is currently advancing through Congress and has significant implications for small businesses and independent developers. While aimed at enhancing online safety for children, KOSA introduces stringent data collection requirements and broad compliance burdens that could stifle innovation and impact privacy without protecting children. As KOSA moves to the House, we raise key concerns and advocate for a balanced approach that protects young users without overwhelming the digital ecosystem. Our latest blog explores these hidden dangers and why a balanced approach is essential for protecting both children and the digital ecosystem. Read more here: https://loom.ly/KfR_30w #KOSA #SmallBusiness #TechPolicy #Privacy #Innovation

2

🚨 Are we on the brink of a major change to how we conduct privacy risk assessments? In Episode #57 of the Privay Huddle, Jonathan Joseph and Alysa Hutnik dissect the latest decision from the Ninth Circuit on the California Age Appropriate Design Code. 🏛️ This ruling could reshape how businesses approach DPIAs and redefine what "harm" means in the privacy context. 🔍 The Ninth Circuit struck down the DPIA provision, labeling it as compelled speech, potentially violating the First Amendment. 🔍 This ruling may set a precedent, questioning the role of DPIAs and their implications for privacy laws nationwide. 🔍 We could see future challenges to laws like CCPA and others with stringent data privacy requirements. 🎧 Watch below #DataPrivacy #PrivacyLaw #PrivacyHuddle

14

Can you be a data broker and not even know it? Some businesses may be surprised to find where they fall based on the California Privacy Protection Agency's (CPPA) recent Notice of Proposed Rulemaking (NPRM), which seeks to tighten up the state's data broker registry law. Among other things, the NPRM shifts registration responsibility to new entities that were previously exempt, makes changes to the definition of a “direct relationship” with a consumer, and applies stricter limitations on withdrawing or changing a registration. Affected parties are invited to file comments with the CPPA on these proposed changes. If you want to make your voice heard, we’re here to help. Contact us at mslawgroup.com. 

4

1 Comment