Publications

Last year, the California legislature passed the Online Privacy Protection Act of 2003 (“OPPA”), which takes effect on July 1, 2004. The law applies to “operators” of websites or online services. An “operator” is defined under the OPPA as “any person or entity that owns a website located on the Internet or an online service that collects and maintains personally identifiable information from a consumer residing in California who uses or visits the website or online service if the website or online service is operated for commercial purposes.” Consequently, nearly all websites operated for commercial purposes that are accessible by residents of California will be required to comply with OPPA. OPPA has four key disclosure requirements that must be included in a Privacy Policy statement which is accessible from each page of the website (e.g., from a click-on “hyperlink” button at the bottom of the page): 1. The effective date of the Privacy Policy; 2. Identification of the categories of personally identifiable information that the operator collects about individual consumers who use or visit its website and the categories of third parties with whom the operator may share that personally identifiable information; 3. A description of the process by which the operator will notify users of its website or service when it makes material changes to its privacy policy; and 4. If the operator offers a means for individual users to review and request changes to any of their personally identifiable information, a description of the process by which such users can review and update such personally identifiable information (or, if users are not permitted to review and update such information, a statement to that effect). As a result of the enactment of OPPA, every person or entity that operates a website for commercial purposes that is accessible by residents of the State of California should review the Privacy Policy statement at their website to confirm whether it is in compliance with OPPA. Most likely, some revision of the Privacy Policy statement will be required.