Technology Commentaries: California First State To Require Online Privacy Policies

In 2003, California enacted groundbreaking consumer rights legislation in the areas of database security, sharing of personal financial information, spam, and the use of personal information in direct marketing.¹ Maintaining its pioneer status, California is the first state to require that all companies that collect personal information online from California residents must post online privacy policies that describe their practices in a conspicuous manner. Although it is relatively easy to comply with the statute, the failure to do so could expose companies to consumer lawsuits, including class actions, under California’s prohibition of unfair business practices generally.

The Online Privacy Protection Act of 2003 (AB 68), codified as California Business and Professions Code § 22575 et seq., requires that entities collecting "personally identifiable information" from California residents for a commercial purpose conspicuously post a privacy policy disclosing what information is being