Law / United States / 
California
Shine the Light law
Officially Shine the Light Law: customer requests for third-party direct marketing disclosures
Cal. Civ. Code sections 1798.83 and 1798.84
In force since .
A data subject rights rule binding private bodies.
- Obligation class
- Disclosure, Data subject rights
- Audit expectation
- none
As of .
What it requires
- If you are a business with 20 or more full-time or part-time employees, have an established business relationship with a California customer who deals with you primarily for personal, family, or household purposes, and in the preceding calendar year disclosed that customer's personal information to third parties you know or reasonably should know used it for their own direct marketing, answer the customer's request for the disclosures below, free of charge.
- Tell the customer, in writing or by email, which of the listed categories of personal information you disclosed to third parties for their direct marketing during the preceding calendar year. The categories include name and address, email address, age or date of birth, telephone number, occupation, the kind of product or service the customer bought, Social Security number, payment card numbers, payment history and creditworthiness.
- Tell the customer, in writing or by email, the names and addresses of all the third parties that received the information for their direct marketing during the preceding calendar year and, if the nature of a third party's business cannot reasonably be determined from its name, examples of the products or services marketed, if you know them.
- Designate a mailing address, an email address or, if you choose to take requests by telephone or fax, a toll-free number for these requests, and do at least one of three things: tell the managers and supervisors of employees who regularly deal with customers to give the designated contact to anyone who asks about your privacy practices; put a link titled "Your Privacy Rights" on your home page, or add those words to your privacy policy link; or make the designated contact available on request at every place of business in California where you regularly deal with customers.
- Answer a request received at a designated address or number within 30 days, and a request received anywhere else within a reasonable period that does not exceed 150 days from receipt.
- You need not answer the same customer more than once in a calendar year, and you may give the information in a standardized format without associating it with specific individuals.
- As an alternative to answering, if your privacy policy publicly states that you disclose customer information for third parties' direct marketing only after the customer first affirmatively agrees, or not if the customer has opted out, you may tell the customer of the right to prevent disclosure and give a cost-free way to use it, so long as you maintain and disclose that policy.
- A disclosure under a contract for processing, storage or services on your behalf, for your own marketing that discloses nothing to third parties, for servicing accounts, to or from a consumer reporting agency, or to a financial institution to obtain payment is not a disclosure for direct marketing purposes, and a financial institution subject to the California Financial Information Privacy Act is outside this section if it complies with the Financial Code sections the subdivision names.
These lines are LexLint's reading of the law's text, as of . Also read by: California Office of Privacy Protection, California Department of Justice (Recommended Practices on California Information-Sharing Disclosures and Privacy Policy Statements, November 2004, revised April 2008) (guidance, recorded ).
If you get it wrong
Criminal exposureNo
Private right of actionYes
Statutory damages
Civil Code section 1798.84(c): for a willful, intentional, or reckless violation of section 1798.83, a customer may recover a civil penalty not to exceed $3,000 per violation, and otherwise a civil penalty of up to $500 per violation. Both figures are ceilings. A prevailing plaintiff also recovers reasonable attorney's fees and costs under section 1798.84(g).
- As of
Who enforces it
Enforcement body
Customers enforce the duty themselves through civil actions under Civil Code section 1798.84, which also provides that a business that violates the title may be enjoined.
Settledness
The Office of Privacy Protection's recommended practices read the section to apply to businesses with 20 or more employees, an established business relationship with a customer who is a California resident, and customer information shared with other companies for their direct marketing use.
- As of
- Guidance link
- https://oag.ca.gov/sites/all/files/agweb/pdfs/privacy/COPP_bus_reportinfo_sharing1.pdf
- Guidance body
- California Office of Privacy Protection, California Department of Justice (Recommended Practices on California Information-Sharing Disclosures and Privacy Policy Statements, November 2004, revised April 2008)
- Open questions
- Does the exemption in section 1798.83(c)(1) for "a business with fewer than 20 full-time or part-time employees" count only a business's employees in California or all of its employees?
- Does a business "know or reasonably should know" under section 1798.83(a) that a purchaser of its customer list used the information for "direct marketing purposes" when the terms of sale say nothing about how the purchaser will use it?
What this law does
Requires a business that has an established business relationship with a California customer, and that in the preceding calendar year disclosed the customer's personal information to third parties it knows or reasonably should know used it for their direct marketing, to give the customer on request and free of charge the categories of information disclosed and the names and addresses of the recipients. A business with fewer than 20 full-time or part-time employees is exempt.
A customer is a California resident whose relationship with the business is primarily for personal, family, or household purposes. A relationship that is no longer ongoing and rests solely on a purchase, rental, or lease counts as established for 18 months from that date. A request received at a designated address or number must be answered within 30 days, and a request received elsewhere within a reasonable period not exceeding 150 days.
A business that publicly adopts a policy of disclosing customer information for third parties' direct marketing only with the customer's affirmative agreement, or not at all after an opt-out, may comply by notifying the customer of the right to prevent disclosure and giving a cost-free means to exercise it.
Disclosures under processing and servicing contracts, the business's own marketing that discloses nothing to third parties, account servicing, consumer reporting, payment processing, and certain public-record, joint-offer, agent and private-label card arrangements are not disclosures for direct marketing purposes. A financial institution subject to the California Financial Information Privacy Act is outside the section if it complies with the sections of the Financial Code the subdivision lists.
A business that discloses to affiliates sharing its brand name may meet the duty to name recipients by giving the overall number of those affiliated companies. A customer may recover a civil penalty of up to $500 per violation of the section, or up to $3,000 per violation that is willful, intentional, or reckless. A prevailing plaintiff recovers reasonable attorney's fees and costs.
Unless the violation is willful, intentional, or reckless, a business has a complete defense if it provides the missing or accurate information to all affected customers within 90 days of the date it knew of the failure. A waiver of a provision of the title is void and unenforceable.
When LexLint raises it
When your app profile says your app sends automated outreach or tracks devices.