California Shine the Light Law

Complying with California’s overlapping privacy laws can be tricky. Here are three reminders:

The California Consumer Privacy Act/California Privacy Rights Act applies to your business if in the last calendar you either bought, sold, or shared the personal information of 100,000+ Californians or had gross annual revenues greater than $25,000,000. Note that the threshold will rise to $26,625,000 next year when you are looking back at your 2025 revenues.

Even if you don’t meet those thresholds, the California Shine the Light law may apply to you. If you have an established business relationship with a California customer, that customer has the right to ask you once per year which categories of personal information about that customer you disclosed to third parties for direct marketing purposes, along with the names and addresses of those third parties. Some private law firms have started sending letter requests under this law in the hope of creating a legal claim. Note that if you have CCPA/CPRA-compliant policies and practices, you satisfy Shine the Light requirements.

Finally, private law firms are also actively filing lawsuits and arbitration demands under the California Invasion of Privacy Act alleging that businesses are unlawfully collecting clickstream data about their online browsing. These claims are being pursued without regard to whether businesses are meeting their CCPA/CPRA or Shine the Light obligations.

If you have questions about any of these complicated and intersecting California laws, please reach out to a member of our team:

Stacy Stitham, sstitham@brannlaw.com
David Swetnam-Burland, dsb@brannlaw.com
Nathaniel Bessey, nbessey@brannlaw.com