Does your website or application collect user data? Does your company sell that user data to other third parties, such as advertisers? Does your company disclose this practice to your users in a privacy policy or terms or use? If you answered yes to these questions, you are most certainly not alone. But is your disclosure sufficient? That is the question a new challenge is poised to answer.
The Weather Channel (TWC) uses a mobile application that, like many others, collects information about its users, namely geolocation data. TWC then sells that user data to third-party advertisers, an activity that it discloses to its users in its privacy policy. But in a new complaint filed January 3 in the Superior Court of the State of California, the City of Los Angeles, on behalf of the people of the State of California, argues TWC violated California’s Unfair Competition Law (Business & Professions Code §§ 17200-17210) by amassing its profits through a business practice unknown to its customers. The city alleges TWC “deceptively used its Weather Channel App to amass its users’ private, personal geolocation data—tracking minute details about its users’ locations throughout the day and night, all the while leading users to believe that their data will only be used to provide them with ‘personalized local weather data, alerts and forecasts.’ TWC has then profited from that data, using it and monetizing it for purposes entirely unrelated to weather or the Weather Channel App.”
The city does not allege that TWC has made no disclosure or received no consent from its users, as the app in fact discloses its practices in a lengthy privacy policy—that users must seek out on their own—and obtains user consent prior to collecting any geolocation data. Rather, it alleges TWC has failed to do so in a “conspicuous” manner in a “location that reasonable consumers are likely to read,” and that TWC misled consumers through its marketing to believe that the use of such data was solely for the purpose of providing users with personalized weather information. At issue is whether such privacy policy disclosure is sufficient for the actual (albeit unmarketed to end users) business practice.
The city seeks to enjoin TWC from engaging in the unfair business practice and seeks monetary relief of $2,500 for each violation, as afforded under Section 172016(a) of the Unfair Competition Law.
This case comes at an interesting time, in the period before the California Consumer Privacy Act (CCPA), which we have previously discussed, takes effect. It appears the city is testing to see whether it has other means by which to bring privacy claims in the meantime.