On January 16, California Attorney General Rob Bonta announced that his office is conducting an investigative sweep of online streaming services for alleged violations of the California Consumer Privacy Act (CCPA). The sweep is focused specifically on whether these services have failed to comply with the CCPA's opt-out rules.

“From watching live sporting events to blockbuster movies, families increasingly use streaming platforms for entertainment, and we must make sure that their personal information is protected," said Bonta. "Today, we are taking a close look at how these streaming services are complying with requirements that have been in place since 2020."

By targeting online streaming services, the investigation indicates that the Attorney General believes these services are selling or sharing users' personal information. Under the CCPA, "selling" doesn't mean just exchanging data for money, but also includes receiving discounted prices or access to personal data from other sources (so-called "data cooperatives") in return. "Sharing" means using personal data for behavioral or targeted advertising.

If it is true that these businesses are selling or sharing personal information, the CCPA requires them to disclose that fact and offer a simple method for opting out. (Hence the proliferation of "Do Not Sell or Share My Personal Information" links on websites.) If a user is logged in, as is typically the case with a streaming service, the business must apply the opt out to all other devices associated with that user as well.

Although the state now has a dedicated agency for privacy enforcement, the California Privacy Protection Agency, the Attorney General retains concurrent authority to enforce the CCPA, and it seems clear that he intends to continue exercising that authority. As the California Privacy Protection Agency has been busy staffing up over the last year, businesses should expect robust privacy enforcement in the near future.

‍