Shine the Light

Cal. Civ. Code § 1798.83

California Shine the Light law

In force since January 1, 2005

Who it applies to

  • Businesses with 20 or more employees that disclose personal information to third parties for those third parties' direct marketing purposes

Consumer rights

  • Access / know — grantedObtain the personal data held about you, and the categories, sources and purposes behind it.
  • Correction — not granted
  • Deletion / erasure — not granted
  • Portability — not granted
  • Opt out of sale / sharing — not granted
  • Opt out of targeted advertising — not granted
  • Opt out of profiling — not granted
  • Limit sensitive data use — not granted
  • Human review of automated decisions — not granted
  • Non-discrimination — not granted
  • Appeal a refusal — not granted
  • Private right of action — grantedSue directly, rather than relying on a regulator to enforce on your behalf.

Obligations

Consent model
Opt-out
Universal opt-out signal
Not required
Risk assessments
Not required
Data protection officer
Not required
Records of processing
Not required
Processor contract
Not required
Right to cure
None — enforcement may follow immediately
Data broker registration
Not required

Breach notification

To individuals
Not addressed by this section
To the regulator
Not required by this law
What triggers it
Not addressed by this section

Penalties

Headline
$500 per violation, rising to $3,000 for a wilful violation
Private right of action
Yes — individuals can sue directly
Notes
Predates the CCPA by fifteen years and still stands alongside it. A business may comply by offering a free opt-out of such disclosures instead of answering requests.

Exemptions

Entities

  • Businesses with fewer than 20 employees

Sources